Use an External KMS for Credential Encryption Keys
You can store the master keys you use to encrypt and decrypt stored data credentials in an external key management system (KMS). By providing direct control over encryption keys, using an external KMS can help enhance the security posture for organizations, meet regulatory mandates, and maintain data sovereignty.
For general information on the benefits of using an external KMS for key management, see Use an External KMS for Key Management.
Note: The External KMS for Credential Encryption Keys feature is available starting with Tableau Cloud August 2026 if you have Tableau +, Tableau Enterprise, or Advanced Management. If at some point you no longer have Tableau +, Tableau Enterprise, or Advanced Management, working with your encrypted objects will still work, but you won't be able to manage keys.
Setup overview
The summary-level steps to use the AWS KMS for storing data credentials encryption keys are:
- Enable extract encryption using an external KMS
- Enable credentials encryption
- Generate a data key in Tableau
Key statuses
When using an external KMS, the keys used for credential encryption in Tableau Cloud have these statuses and capabilities::
- Active — The key is being used to encrypt credentials, and to decrypt credentials that it encrypted.
- Archived — The key was active in the past, but was superseded by a later key. It's not being used to encrypt credentials, but is being used to decrypt credentials that it encrypted.
- Deactivated — The key was active in the past, was later archived, and has since been deactivated. It's not being used for encrypting or decrypting any credentials.
Status quick reference
| Key status | Can encrypt credentials | Can decrypt credentials |
|---|---|---|
| Active | ✓ | ✓ |
| Archived | ✓ | |
| Deactivated |
Setup details
Configuration starts with:
- Log in to your Tableau Cloud site.
- Select Settings in the left navigation pane.
- Select the Security tab.
1. Enable extract encryption using an external KMS
To use an external KMS for data credential encryption, enable external KMS for extract encryption first. See the "Setup Details" section of Use an External KMS for Extract Encryption Keys.
2. Enable credentials encryption
To enable credentials encryption:
- Under the Credentials Encryption section, select Encrypt saved credentials.
3. Generate a data key
To encrypt and decrypt saved data credentials, generate a data key.
To generate a data key:
- Under the Credentials Encryption section, select Generate Data Key.
- In the dialog, select Generate Data Key. Note that you can't generate more than one data key in a 7 day period. If the dialog doesn't contain the Generate Data Key button, it means you've generated a data key within the last 7 days.
After generation, the new key's status is Active, which means it's being used to encrypt and decrypt stored data credentials.
Note: After you enable encryption and activate the first key on a site, Tableau Cloud creates encryption jobs for all data credentials on your site. These jobs run in the background and are set to the lowest priority, meaning they run only when there are extra resources.
Other Actions
Archive a key
Archived keys can decrypt credentials they encrypted, but aren't used to encrypt them. The only way to archive a key is by generating a new data key. See Generate a data key.
Deactivate a key
Deactivate an archived key to make it unusable for encrypting or decrypting any stored credentials. You might do this if the key has been compromised. The Deactivate Key action is only available on an Archived key.
When you deactivate a key, it can't be used to decrypt credentials it encrypted (in contrast to an archived key, which can decrypt credentials it encrypted).
Note: You can Restore a deactivated key if necessary. Restoring a key will change it from Deactivated to Archived. See Restore a Key.
To deactivate a key:
- Under the Credentials Encryption section, select actions (...) next to the appropriate Archived key.
- Select Deactivate Key....
- Enter "Deactivate this key" into the text field to confirm your action.
- Select Deactivate Data Key.
Restore a key
Restore a deactivated key to make it usable for decrypting credentials it encrypted. The Restore Key action is only available on a Deactivated key, and changes it to Archived.
When you restore a key to the archived state, it won't be used to encrypt any credentials. It's only used to decrypt credentials that it wrote.
- Under the Credentials Encryption section, select actions (...) next to the appropriate Deactivated key.
- Select Restore Key....
- Select Restore Data Key.
Delete a key
You can't delete credentials encryption keys. A key can only be archived (which retains the ability to decrypt credentials it wrote), or deactivated (which can neither encrypt nor decrypt). See Key Statuses.
Note: If you disable the customer master key (CMK) in the AWS KMS, Tableau keys descended from it stop working for encryption or decryption. Likewise, if you remove the Tableau-generated clause from the CMK's policy in the AWS KMS, Tableau keys descended from it stop working.