Loading
Help Agent Performance DegradationRead More
Set Up and Maintain Your Salesforce Organization
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Rotate an EKM Key

            You are here:

            1. Salesforce Help
            2. Docs
            3. Set Up and Maintain Your Salesforce Organization

            Rotate an EKM Key

            Key rotation refers to the process of updating or changing your key material. You can edit existing key materials or replace them with new ones. If you edit or update your external key, make sure to align your external key details across both Salesforce and AWS KMS.

            Required Editions

            Available in both Lightning Experience and Salesforce Classic (not available in all orgs).
            Available in: Enterprise, Performance, Unlimited, and Developer Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption, and the External Key Management Service. Data 360 customers must also have the Platform Encryption for Consumption license.
            User Permissions Needed
            To generate, destroy, export, import, upload, and configure tenant secrets and customer-supplied key material: Manage Encryption Keys

            Keep these considerations in mind when rotating external keys.

            • If you deactivate or destroy external keys, encrypted key material is evicted from the cache.
            • If you disable, deactivate, or delete the external key or an associated Salesforce data-encryption key, related Salesforce data encrypted with that key is no longer accessible.
            • As a best practice, rotate data encryption keys in sandboxes after a refresh. Rotation ensures that production and sandbox orgs use different data encryption keys. You can’t activate or deactivate in a sandbox an external key created in production.
            1. From Setup, in the Quick Find box, enter Platform Encryption, and then select Key Management.
            2. Click Manage External Keys.
            3. Choose to either use the latest configuration of the current key or to use a different key.
            4. Complete the steps on screen.

            Store or version your old keys securely, in case you need them again someday. Communicate the change you made so others who need to know are aware.

            See Also

             
            Loading
            Salesforce Help | Article