Customer-managed keys: AWS KMS
This page sets up an AWS KMS key to protect your organization’s stored Syntic content. How customer-managed keys work is on Customer-managed keys.
Before you start
- An AWS account for security resources and permission to create KMS keys and edit key policies.
- An Owner of the Syntic organization to register the key.
Find Syntic’s role
In the Console, open Settings → Security → Encryption, select Use my own key and choose AWS. The page shows the AWS account and IAM role Syntic uses for your organization, and an external id.
Create a symmetric key with a scoped policy
Create a symmetric encryption key in the region nearest your data region. Add a statement to its key policy that lets Syntic’s role use the key for encryption only:
{
"Sid": "AllowSynticEnvelopeEncryption",
"Effect": "Allow",
"Principal": { "AWS": "<role ARN shown in the Console>" },
"Action": ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
"Resource": "*",
"Condition": {
"StringEquals": { "kms:EncryptionContext:syntic_org": "<your Syntic organization id>" }
}
}In a key policy, "Resource": "*" means this key. The encryption-context condition ties every use to your organization’s id, which Syntic always sends.
Turn on rotation
Enable automatic key rotation if your policy requires it. Rotation keeps the same key ARN, so nothing changes on the Syntic side.
Register the key
curl -sS -X PUT https://app.syntic.ai/v1/organizations/encryption_key \
-H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
-H "Content-Type: application/json" \
-H "syntic-beta: admin-2026-11-01" \
-d '{"provider": "aws",
"key_ref": "arn:aws:kms:eu-central-1:123456789012:key/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
"reencrypt_existing": true}'Operating the key
- Audit: CloudTrail records each KMS call Syntic’s role makes, with the encryption context.
- Cutting access: disabling the key or removing the policy statement makes protected content unreadable within about 5 minutes. The status shown by Get the encryption key becomes
revoked. - Deletion: a KMS key scheduled for deletion can be cancelled during its waiting period; after deletion the protected content is permanently unreadable.
Use a dedicated key for Syntic. Sharing a key with other systems widens who can affect your Syntic data and makes the audit trail harder to read.