Use an External KMS for Extract Encryption Keys

Applies to: Tableau Cloud

You can store the master keys you use to encrypt and decrypt extracts in an external key management system (KMS). By providing direct control over encryption keys, using an external KMS can help enhance the security posture for organizations, meet regulatory mandates, and maintain data sovereignty.

For general information on the benefits of using an external KMS for key management, see Use an External KMS for Key Management.

Note: The External KMS for Extract Encryption feature is available starting with Tableau Cloud February 2026 if you have Tableau +, Tableau Enterprise, or Advanced Management. If at some point you no longer have Tableau +, Tableau Enterprise, or Advanced Management, working with your encrypted objects will still work, but you won't be able to manage keys.

Setup overview

The summary-level steps to use the AWS KMS with Tableau are:

AWS KMS: Create the customer master key (CMK).
Tableau Cloud: Enable extract encryption (or migrate from customer-managed encryption keys, which uses the Salesforce KMS).
Tableau Cloud: Generate a key in Tableau, using the customer master key's ARN from the AWS KMS.
AWS KMS: Add the Tableau key policy JSON to the AWS customer master key's policy.
Tableau Cloud: Activate the key.

Key statuses

When using an external KMS, the keys used for extract encryption in Tableau Cloud have these statuses and capabilities:

Pending — You generated the key, but aren't using it yet. It can't be used to write or read any extracts until you activate it.
Active — The key is being used to write extracts, and to read extracts that it wrote.
Archived — The key was active in the past, but was superseded by a later key. It's not being used to write extracts, but is being used to read extracts that it wrote.
Deactivated — The key was active in the past, was later archived, and has since been deactivated. It's not being used for reading or writing any extracts.

Status quick reference

Key status	Can write/encrypt extracts	Can read/decrypt extracts
Pending
Active	✓	✓
Archived		✓
Deactivated

Setup details

Configuration starts with:

Log in to your Tableau Cloud site.
Select Settings in the left navigation pane.
Select the Security tab.

1. Create a master key in the AWS KMS

The keys that Tableau uses for encryption are based on customer master keys (CMKs) that exist in the AWS KMS(Link opens in a new window). Therefore, you need a CMK in the AWS KMS before Tableau can generate keys.

The Tableau key generation dialog contains a link to the AWS KMS(Link opens in a new window) so that you can create a CMK or get info about one that already exists. If you need help with keys in the AWS KMS, consult with your local key expert.

AWS keys are uniquely identified by an Amazon Resource Name (ARN). You’re asked to provide the CMK ARN during the Tableau key generation process. Key ARNs are formatted like:

arn:aws:kms:us-east-2:123456789012:key/12345678-90ab-cdef-1234-567890abcdef

After the customer master key is created in AWS, you can enable extract encryption in Tableau Cloud.

2. Enable extract encryption with an external KMS

Note: After you enable encryption, you can't disable it. Similarly, switching from customer-managed encryption keys (using the Salesforce KMS) to an external KMS is permanent and can't be undone.

To enable an external KMS:

Under the Extract Encryption section, select Encrypt Extracts.
Select Use an external KMS.
- If Use the Salesforce KMS is already selected, you're currently using customer-managed encryption keys through the Salesforce KMS. (For more information, see Customer-Managed Encryption Keys(Link opens in a new window).) Changing the setting to Use an external KMS will irreversibly change from the Salesforce KMS to an external KMS. Before you change your KMS, see Migrate from Customer-Managed Encryption Keys to External KMS.
Select Generate Key.
- If you're migrating from the Salesforce KMS to an external KMS, read the warning, then select Switch to External KMS.

3. Generate a key

Generating a key is the first step towards reading and writing encrypted extracts. If you already have an active key, you generate another key as a first step towards replacing the currently active key.

To generate a key in Tableau:

Under the Extract Encryption section, select Generate Key.
If you're generating the first key for a site, you see the Configure the AWS KMS dialog. If you already have an active key, proceed through the Generate Key confirmation dialog first.
Select Launch the AWS KMS and log in if needed.
In the AWS KMS, create a new key or find an existing one, then copy the key ARN. If you need help with keys in the AWS KMS, consult with your local key expert.
Return to the Tableau Configure the AWS KMS dialog and paste the key ARN into the Key ARN from AWS field.
Optionally, enter a Description.
Select Next (or Enable Encryption, if this is the first key for the site).
Select Done to add the key policy JSON to the AWS KMS later, or follow Add Key Policy JSON to KMS Key Policy to do it now.

The key can't be used to read or write extracts until you add the key policy JSON to the AWS KMS policy and then activate it.

4. Add key policy JSON to KMS key policy

A newly-generated key has a status of Pending. It can't be used to read or write extracts until you add the key policy JSON to the AWS KMS policy and then activate it.

To see the key policy JSON, continue from the Generate a Key process.

Or, if you're not continuing from that process:

Under the Extract Encryption section, select actions (...) next to the appropriate Pending key.
Select Key Policy.

To add the key policy JSON to the AWS KMS policy, copy the relevant Statement object from Tableau to the policy JSON in the AWS KMS. You only need part of the complete JSON text. Keep in mind that selecting Copy Key Policy for pasting and editing in a text editor can be easier.

From the JSON text, copy the object in the Statement array. Then, in the AWS KMS key's policy, add the copied text to the Statement array, following standard JSON syntax. (You may need to add a comma to the end of the existing AWS KMS's Statement array before adding the new JSON.)

Example:

The highlighted portion is the section to add to the AWS KMS policy:

{
    "Version": "2012-10-17",
    "Id": "sfdc-key-access-policy",
    "Statement": [
        {
            "Sid": "AllowSalesforceShieldKeyBroker1234567890abc",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:sts::123456789abc:assumed-role/EkmAwsKmsAccessRole/1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ12"
            },
            "Action": [
                "kms:GenerateDataKey*",
                "kms:Decrypt"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:EncryptionContext:sf-auth": "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ"
                }
            }
        }
    ]
}

5. Activate a key

Activate a key to use it for reading and writing new extracts. The Activate Key action is only available on a Pending key.

Under the Extract Encryption section, select actions (...) next to the appropriate Pending key.
Select Activate Key....

If you already have an active key, activating a new key changes the existing key status to Archived. An archived key is only used to read extracts that it wrote. The new key will become Active, and will be used to write new extracts and read extracts that it wrote.

Note: After you enable encryption and activate the first key on a site, Tableau Cloud creates an extract encryption background job for each extract on your site. These jobs are set to the lowest priority, meaning they run only when there are extra resources. Existing extract refresh jobs run before extracts are encrypted.

Other actions

Archive a key

Archived keys can read extracts they wrote, but aren't used to write new extracts. The only way to archive a key is by activating a new key. See Activate a Key.

Deactivate a key

Deactivate an archived key to make it unusable for reading or writing any extracts. You might do this if the key has been compromised. The Deactivate Key action is only available on an Archived key.

When you deactivate a key, it can't be used to read extracts it wrote (in contrast to an archived key, which can read extracts it wrote). This means that some extract-based content could stop working if it hasn't been encrypted with an active key. If you need to retain access to extract-based content that uses the old key, make sure the extracts are refreshed with an active key before deactivating the old one.

Note: You can Restore a deactivated key if necessary. Restoring a key will change it from Deactivated to Archived. See Restore a Key.

To deactivate a key:

Under Extract Encryption section, select actions (...) next to the appropriate Archived key.
Select Deactivate Key....
Enter "Deactivate this key" into the text field to confirm your action.
Select Deactivate Key.

Restore a key

Restore a deactivated key to make it usable for reading extracts it wrote. The Restore Key action is only available on a Deactivated key, and changes it to Archived.

When you restore a key to the archived state, it won't be used to write any extracts. It's only used to read extracts that it wrote.

Log in to your Tableau Cloud site.
Select Settings in the left navigation pane.
Select the Security tab.
Under Extract Encryption section, select actions (...) next to the appropriate Deactivated key.
Select Restore Key....
Select Restore Key.

Delete a key

You can't delete extract encryption keys. A key can only be archived (which retains the ability to read content it wrote), or deactivated (which can neither read nor write). See Key Statuses.

Note: If you disable the customer master key (CMK) in the AWS KMS, Tableau keys descended from it stop working for encryption or decryption. Likewise, if you remove the Tableau-generated clause from the CMK's policy in the AWS KMS, Tableau keys descended from it stop working.

See key policy

The Key Policy dialog shows the key policy JSON for adding to the AWS KMS key's policy. The key policy JSON can be added during the Generate a Key process, or later.

For more information, see Add Key Policy JSON to KMS Key Policy.

To see the key's policy JSON:

Under the Extract Encryption section, select actions (...) next to the appropriate key.
Select Key Policy.

See key history

Each row of the key history table shows an event, the key status after the event, and the date and time of the event.

To see a key's history:

Under the Extract Encryption section, select actions (...) next to the appropriate key.
Select Key History.

Test configuration

Use the Test Configuration action on a pending key to determine if it can be activated. Use the Test Configuration action on keys with other statuses to show whether they’re working, should work, or won't work.

To test the configuration for a key:

Under the Extract Encryption section, select actions (...) next to the appropriate key.
Select Test Configuration....

Success:

The key can be used to encrypt extracts. If the key is pending, it’s safe to activate. If the key is already active, it’s working.

Errors:

POLICY_DENIED — The external KMS doesn't have a policy that allows this key. Confirm that you've copied the policy from this key to the external KMS.
KEY_NOT_FOUND — The key wasn't found, or the key is deactivated in Tableau. Confirm the AWS KMS key ARN and policy.
UNKNOWN — An unknown error occurred. Make sure the key isn't disabled in the AWS KMS and try again.

Thanks for your feedback!

Your feedback has been successfully submitted. Thank you!

Tableau Cloud Help