External Key Management
Shield External Key Management (EKM) connects your Salesforce implementation to your key material in an external key management service (KMS). Shield Platform Encryption then uses that key material to encrypt and decrypt your Salesforce data. EKM fetches your keys on demand from the external KMS over a secure channel.
Required Editions
| Available in both Lightning Experience and Salesforce Classic (not available in all orgs). |
| Available in: Enterprise, Performance, Unlimited, and Developer Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption, and the External Key Management Service. Data 360 customers must also have the Platform Encryption for Consumption license. |
| User Permissions Needed | |
|---|---|
| To generate, destroy, export, import, upload, and configure tenant secrets and customer-supplied key material: | Manage Encryption Keys |
With EKM, you get the benefits built into Salesforce Shield Platform Encryption plus the extra assurance that comes from managing keys with your preferred key management service. Unlike Salesforce’s Cache-Only Key Service, EKM integrates natively with external key management services for a quicker, more streamlined user experience. It’s compatible with most categories of data that Shield Platform Encryption supports, such as field-level encryption, Data 360, and search indexes. EKM isn’t compatible with Backup & Recover Next.
For Shield Platform Encryption features that use their own tenant secret, such as fields or files and attachments, EKM manages your tenant secret. EKM stores your tenant secret in the key cache and uses your key for immediate encrypt and decrypt operations.
For Shield Platform Encryption features that use a root key, such as Platform Encryption for Data 360 and search index encryption), EKM manages your root key.
Salesforce doesn’t retain or persist your cached EKM keys in any system of record or backups. You can revoke key material at any time.
- How Salesforce Shield EKM Works
With External Key Management (EKM), customers designate and use an external key management service (KMS) to manage data encryption keys (DEKs) in Salesforce. These DEKs encrypt and decrypt data. When not in use, Salesforce stores DEKs in a wrapped (encrypted) state within Shield Platform Encryption's key cache. For any encrypt or decrypt operation, Shield Platform Encryption sends the wrapped DEK to the customer's external key service, which then unwraps it and securely returns it. - EKM Prerequisites
To use EKM, you must create a data encryption key (DEK) of sufficient strength in a supported external key management service. You should also check that an external application can communicate with the key service to securely retrieve the DEK. - Key Coordination Policy Setup
Track the status of both the external KMS key and the Salesforce EKM key that depends on it. - Connect Salesforce to AWS KMS and Create a Data Encryption Key
When you configure your connection between Salesforce and AWS, you provide information about the AWS KMS key that you want Salesforce to use (key identifier, region, and description). You then generate a JSON structure and add that structure to your key policy in the AWS console for your key. - Key Maintenance and Auditing for EKM
Common key operations include auditing, deactivating, reactivating, rotating, and checking the connection to your external keys. These operations affect the keys identified in your Salesforce setup. The original keys in the external KMS are managed by a separate external process. - EKM in a Sandbox Org
A sandbox org that’s copied, refreshed, or cloned from a source org that uses EKM keys is granted minimum access to the source org’s keys, so that it can decrypt any encrypted data it inherited from the source org. A sandbox org can’t manage its source org's keys in any way, because sandboxes have limited access to those keys. Rotate the keys in a sandbox org as soon as you create it.
