Encrypting your Amazon Quick data with Amazon Key Management Service customer-managed keys

On the Amazon Quick start page, choose Manage Amazon Quick, and then choose KMS keys.

On the KMS keys page, choose Manage. The KMS keys dashboard opens.

On the KMS Keys dashboard, choose Select key.

On the Select key pop-up box, choose Key to open the list. Then, select the key that you want to add.

If your key isn't in the list, you can manually enter the key's ARN.

(Optional) Select the Use as default encryption key for all new data in the current region of this Amazon Quick account to set the selected key as your default key. A badge appears next to the default key to indicate its status.

When you choose a default key, all new data that is created in the region that hosts your Amazon Quick account is encrypted with the default key.

(Optional) Add more keys by repeating the previous steps in this procedure. While you can add as many keys as you want, you can only have one default key at one time.

Navigate to your CloudTrail log. For more information, see Logging Amazon Quick information with CloudTrail.

Locate the most recent grant events for the SPICE dataset, using the following search arguments:

{
"eventVersion": "1.08",
"userIdentity": {
"type": "AWSService",
"invokedBy": "quicksight.amazonaws.com"
},
"eventTime": "2022-10-26T00:11:08Z",
"eventSource": "kms.amazonaws.com",
"eventName": "CreateGrant",
"awsRegion": "us-west-2",
"sourceIPAddress": "quicksight.amazonaws.com",
"userAgent": "quicksight.amazonaws.com",
"requestParameters": {
"constraints": {
    "encryptionContextSubset": {
        "aws:quicksight:arn": "arn:aws-cn:quicksight:us-west-2:111122223333:dataset/12345678-1234-1234-1234-123456789012"
    }
},
"retiringPrincipal": "quicksight.amazonaws.com",
"keyId": "arn:aws-cn:kms:us-west-2:111122223333:key/87654321-4321-4321-4321-210987654321",
"granteePrincipal": "quicksight.amazonaws.com",
"operations": [
    "Encrypt",
    "Decrypt",
    "DescribeKey",
    "GenerateDataKey"
]
},
....
}

Depending on the event type, one of the following applies:

CreateGrant – You can find the most recently used CMK in the key ID (keyID) for the last CreateGrant event for the SPICE dataset.

RetireGrant – If latest CloudTrail event of the SPICE datasets is RetireGrant, there is no key ID and the resource is no longer CMK encrypted.

Navigate to your CloudTrail log. For more information, see Logging Amazon Quick Sight information with Amazon CloudTrail.

Locate the most recent GenerateDataKey events for the report execution, using the following search arguments:

{
    "eventVersion": "1.11",
    "userIdentity": {
        "type": "AWSService",
        "invokedBy": "quicksight.amazonaws.com"
    },
    "eventTime": "2025-07-23T23:33:46Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "GenerateDataKey",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "quicksight.amazonaws.com",
    "userAgent": "quicksight.amazonaws.com",
    "requestParameters": {
        "keyId": "arn:aws:kms:us-west-2:111122223333:key/87654321-4321-4321-4321-210987654321",
        "keySpec": "AES_256",
        "encryptionContext": {
            "aws:quicksight:arn": "arn:aws-cn:quicksight:us-west-2:111122223333:dashboard/1ca456fe-eb34-4250-805c-b1b9350bd164",
            "aws:s3:arn": "arn:aws-cn:s3:::sn-imagegen.prod.us-west-2"
        }
    },
    ...
}

aws:s3:arn is the Amazon Quick owned S3 bucket where your report artifacts are stored.

If you no longer see GenerateDataKey, then new report executions are no longer CMK encrypted. Exisiting report artifacts will remain encrypted.

On the Amazon Quick start page, choose Manage Amazon Quick, and then choose KMS keys.

Choose MANAGE to open the KMS keys dashboard.

Navigate to the key that you want to set as your new default. Choose Actions (three dots) on the row of the key that you want to open the key's menu.

Choose Set as default, and then choose Set.

On the Amazon Quick start page, choose Manage Amazon Quick, and then choose KMS keys.

On the KMS keys page, choose Manage to open the KMS keys dashboard.

Choose Actions (three dots) on the row of the default key, and then choose Delete.

In the pop-up box that appears, choose Remove.

Log in to your Amazon account, open Amazon KMS, and choose Customer managed keys.

Select the key that you want to turn off.

Open the Key actions menu and choose Disable.

Restore access to the CMK. Usually, this is enough to recover the Amazon Quick data.

Test the Amazon Quick data to check if you can see it.

(Optional) If the data is not fully recovered, even after you restored its access to the CMK, perform a full refresh on the data.