View the Archive Console

Add a New Service

You can manually add a new service to the Archive Console if your service is in the same region, and the service has a package installed. Only the Main Admin and Admin can add a new service.

Note The Admin responsible for a specific Business Unit (BU) must first have a service assigned to a BU.

1. Go to the Archive tab.
2. Click New Archive Service.
   The Add Service window opens.
3. Select the Add New Service tile.
4. Enter the name of the service.
5. From the Org Type downdown list, select Sandbox or Production.
6. From the Region dropdown list, select a region.
7. Click Authenticate.
   The Salesforce login page appears.
8. Select a username, and sign in to your Salesforce instance.
9. Click Allow.
   When your Salesforce instance is connected to the Archive Console, you're redirected to the Archive tab.
   

   Note The instance must have a package installed, and be connected to the same region. An error message is displayed if you don't have the correct permissions for the BU.

Add an Existing Service

1. Go to the Archive tab.
2. Click New Archive Service.
   The Add Service window opens.
3. Select the checkbox for the orgs you want to add.
   If you hover over the service name, you can view the org ID.
4. Click Add.
   A success message appears:
   The page automatically refreshes, and the orgs appear in the list as follows:

Manage Services in the Archive Console

Edit an Archive Service

1. Click the More Actions (three dots) menu.
2. Select Edit.
3. Enter the new details.
4. Click Save.

Remove an Archive Service

1. Click the More Actions (three dots) menu.
2. Select Remove.
   

   Note This only removes the instance from the list. It doesn't remove the installed package. Any instances related to Bring Your Own Key (BYOK) can't be removed unless you delete the BYOK from that specific service.
   

   Note You can't currently import policies among services that have Package #21 installed.

Customize Policy Table Fields

Note Available for services from Archive Package 16 and later.

To set up your view of the Policy table fields:

1. Click Display Settings.
2. Add as many fields as you need from the Available Fields column to the Selected Fields column on the right.
   Use the up and down arrows to prioritize your display settings.

   Field Name	Description
   Active	Indicates where Archive policy is active. Valid values are yes or no.
   Boost	Indicates whether Boosting is enabled on Archive policy. Valid values are yes or no.
   Content Document	Indicates whether Archive with Content Document feature is checked. Valid values are yes or no.
   Content Document Filter	sObject used to filter Content Document archiving.
   Created By	ID of user who created Archive policy.
   Description	Description of Archive policy.
   Frequency	How often the archive or purge process runs. Valid values are Daily, Weekly, or Monthly.
   Hot Data Threshold	Specific hot data specified in Archive policy. This field is empty if system settings are used.
   Last Modified By	In Archive Console, email of user who last updated the Archive policy. In Archive Console before August 2024, Archive Console User ID. In the Archive package, Salesforce User ID.
   Last Modify Date	Time and date when Archive policy was last modified.
   Limit	Number of records limited per execution in Archive policy.
   Local Hot Data Used	Indicates whether or not hot data is present. Valid values are yes or no.
   Policy Name	Name of Archive policy.
   Policy Type (Record Type)	Archive or Purge
   Query	SOQL created for Archive policy.
   RecordID	Salesforce Record ID of Archive policy.
   Retention Source	Archive Date, Created Date, or Updated Date
   Retention Years	Number of years to retain data.
   Retention Months	Number of months to retain data.
   Scheduled Day (Scheduled On)	Date when Archive policy is scheduled to run. Valid values are the day of the week or the day of the month. If there's no scheduled date, this field remains empty.
   Scheduled Time	Time when Archive policy runs.
   sObject Name	Root object selected.
   Soft Deleted	Indicates where Archive policy soft deleted. Valid values are yes or no.

   

   Note You must select at least one field.
3. Click Save.

Object Selection and Preview

1. Select a root (sObject) from the dropdown list.

   Objects are searchable by API or Table name. The objects on the list are root objects available for deletion from your org. For an object to be archived as a root object, these calls must be supported.

   • create()
   • delete()
   • describeSObject()
   • query()
   • update()

   Any object in your environment that doesn't support all required API calls aren't available in the Archive Object list when creating a policy.

2. In the Limit field, specify up to two million records to archive. The default value is 10.
   To archive more than two million root records daily, create multiple policies with the same SOQL query and schedule them at different times. While each policy is limited to two million root records, the total number of archived records can exceed this due to lookup child records.

   Make sure policies with overlapping SOQL queries or date ranges run at different times.

   Enable Boost to archive up to two million records. For more details, see the Boost section in Advanced Settings.

3. To clear all existing builder content and enable query output for direct editing, switch to Manual mode. Then you can define a custom set of conditions for generating your query using combinations of AND/OR rules.
   

   Note Switching from Manual mode back to Builder mode reverts the query output to this default format.

   SELECT Id FROM Sobject LIMIT X

4. To open the field dropdown list and select the desired object, click + Add Filter. Additional filtering options become available when selecting a date field type object, such as CreatedDate or LastModifiedDate.

   Choose the value to filter by from the Value dropdown list. Click the + icon to add an AND filter. Click + Add OR to include an OR filter.

5. To create complex queries tailored to your needs, manually create a SOQL Query. You can construct a query to archive records based on criteria from the root object.
   For example, to archive all tasks where the parent cases have a status of Closed, use a query structured to include these conditions.

   SELECT Id FROM Task WHERE WhatId IN (SELECT Id FROM Case 
   WHERE status ='On Hold') LIMIT 10

   This query can be applied to all objects.
6. To archive a ContentDocument, use one of these methods.
   • Archive the ContentDocument as a root object by selecting ContentDocument from the Archive sObject dropdown list.
   • Archive the root record and its related ContentDocuments by selecting the root sObject from the dropdown list. The dynamic wizard displays a checkbox for archiving related ContentDocuments. Click the Include Content Documents checkbox.

   This action triggers a warning, prompting you to review and approve the operation before proceeding.

7. To expand the schema selection of related lookup child objects, click the expand icon.
8. Select descendant objects of a lookup by clicking the expand icon next to each item.
   A blue checkmark indicates selection.
9. To expand the hierarchy and view additional child objects, click the expand icon.
   

   Note Selecting a lookup doesn't automatically check all underlying children. Each lookup child must be selected individually.
10. Lookup objects can be selected. However, master-detail and restricted lookups are indicated by a locked icon and can't be selected. You can still click to view and select lookup objects in their hierarchy.
    • The policy is to archive the root record and all selected lookup relations across all levels.
    • If a lookup object is selected and its root object is later unselected during editing, the lookup object is excluded to prevent orphan records.
    • Allow up to 48 hours for any changes to objects, fields, or lookups to be fully processed and visible across all related applications.
      

      Note sObject types often appear multiple times in a schema diagram due to complex relationship structures and are marked with the icon. When an object type is repeated, all instances of that object and associated relationships are treated identically, following the same archiving criteria. For example, when Cases is checked in any part of the hierarchy, all reoccurrences are automatically checked throughout the tree.

      To prevent infinite loops, lookup objects under the same object type become leaf nodes without direct lookup objects. Therefore, lower occurrences of the same object type can't be drilled down. This object type is a recurrence of its ancestor.

      To verify that certain master-detail objects aren't omitted due to the override settings on Field Objects, History Objects, and Exclude Share, go to Archive Settings.

11. To archive the root object and all its descendants, select All. We strongly recommend Admins validate and approve that:
    • Records underneath are archived together with the root object.
    • No limitations or dependencies exist to prevent the whole object from being deleted from Archive.

    For more information, see Archive Multi-Level Objects. For a list of auto-skipped objects, see Salesforce Objects Excluded from Archive.

12. Click Preview.
    The Preview function provides a sample of 10 records based on the policy query and confirms that the policy archives the correct records. This option is available per policy and per user.
13. Optionally, to define the fields viewable in the preview table, click Preview Settings. Then click Save Settings & Close.
    • The ID field is selected by default.
    • You can search and select up to 15 relevant fields.
    

    Note Preview settings are maintained if the same object is selected on future policies.
14. Click Generate Preview.

    The table displays sample records with the selected columns that meet the criteria of the SOQL.

Retention Policy & Advanced Settings

In the Retention Policy section, select one of these sources from the dropdown list.

• Archived Date
• Created Date
• Last Modified Date

Creating a retention period of zero years and zero months means data is automatically purged within 24 hours.

Note When created, you can edit the retention policy.

Consider whether you want the retention period to apply retroactively to existing archived data, or only to records archived from this point forward. Create a policy with an updated retention period to restrict the system to querying only newly archived records. Change the current retention period to impact already archived records and new ones.

Tip If you have a new retention criteria for a specific object, and you don't want previously archived records of that object impacted, stop archiving with this policy and create one with the new retention criteria.

View Imported Policies

1. Select the org that you imported the policies to.
2. Go to the Policies tab.
3. From the dropdown menu, select All Policies.

   The imported policies are displayed in the policy table.

Create and Manage Archive Policies in the Archive Package

You can create policies in either the Archive Package or the Archive Console. The Archive Package only supports archiving single-level lookup relationships, while the Archive Console supports both single- and multi-level archiving.

When created, policies can be viewed, edited, and executed from the Console. Policies created in the Archive Package default to Single-Level archiving mode, but you can switch to Multi-Level archiving by selecting the Multi-Level tab.

Note

Policies created or edited in the Archive Console can't be edited from the Archive Package.

A policy created in the Package and then opened in the Console opens by default in the single-level tab. Switching to Multi-Level resets the query, and selected objects won't be saved.

Create and Manage Archiving Policies in the Archive Console

By default, policies created or edited in the Archive Console open in Multi-Level archiving mode. You can switch to single-level archiving or choose All depending on your requirements.

• Single Level—Archives only one level down the hierarchy.
• Multi Level—Allows relationship drill-down and selection up to 10 levels.
• All—Archives the root object along with all related records in the hierarchy.

Note The Search feature only retrieves results from lookup fields on the first level that are currently exposed. The search results don't include hidden lookup fields further down the hierarchy.

Selecting All does not display the hierarchical structure in the schema. For more information, see Archiving All.

Archive Multi-Level Lookup Objects in the Archive Console

When creating or editing a policy in the Archive Console, a schema on the right-hand side of the screen displays the hierarchy of master-detail and lookup relationship objects for the selected sObject. You can click the first level of the hierarchy to drill down, view, and select its descendant records as needed.

Key

Icon	Meaning
	Objects with a grayed-out checkmark is auto-archived with the root object because a master-detail or restricted lookup relationship exists. To identify restricted lookups, click the Hide Master Details checkbox. This shows the first level of restricted lookups only. Restricted lookups remain in view.
	Objects available for selection
	Access to drill down. Expand the section to reveal the next level of related objects.
	Non-editable master detail-related objects and/or a restricted lookup relationship exist.
	Lookup selected

1. Select Multi-Level
2. Click the + icon next to the desired lookup child object.
   • A hierarchical tree opens, displaying the first level of direct children.
   • A blue checkmark indicates your selection.
   

   Note Changes made to an object's fields may take up to 48 hours to reflect in the schema.
3. To expand master-detail and restricted relationships, click the > arrow icon. This action displays the child objects beneath the current level.
   • Selecting a lookup applies only to the lookup itself. Children of that lookup must be selected individually.
   • Master-detail and restricted lookups display a locked icon, indicating they aren't selectable. However, you can drill down to select lookup objects beneath them.
4. Click Save to archive the root object and the selected lookup relationships across all levels.

   The policy archives the root record and all selected lookup relations across levels.

   

   Note If a child object is selected but its parent is later unselected during editing, the child object is excluded to prevent orphan records in the system.

Important Considerations

Verify Archive Settings

All Archiving

View Policies

Archive Search & Widget Search

Unarchive

Limitations

Activity Log Update

Important Considerations

Install the Enterprise Application

To encrypt the storage account with an encryption key managed in your AKV, the Enterprise application must be installed in your Blob Storage account and granted a role to use the key.

Important The application ID is: 752bf77b-5820-434c-bb2b-c1043be4d995.

Run this az ad sp create command in Azure CLI.

az ad sp create --id <archive_multi_tenant_application_client_id>

Grant the Enterprise Application a Role

If you haven't created the AKV and key to use for your Archive data yet, create them now.

1. Select the AKV you intend to use.
2. Click Access Control (IAM).
3. Go to the Role Assignments tab.
4. Click Add.
5. Select Key Vault Crypto Service Encryption User from the list of Job function roles.
6. Click Next.
7. Click Select Members.
8. In the Select search field, search for and click Own Enterprise application.

   It appears in the Selected Members area beneath the search field.

9. Click Select.

   It appears in the Members list.

10. Click Review + assign.

Create an AKV and Key

1. To create an AKV, log into your Blob Storage account and go to Key Vaults.
2. Click Create.
3. Complete the project details. Select a region that's not correlated to the region of your Own account.
   

   Note When creating your KV, you must turn on the Purge Protection setting.
4. To create a key, on the Key Vault properties page, select Keys.
5. Select Generate/Import.
6. On the Create a Key screen, specify a name for the key.

Set Up Key Rotation for BYOKV

Automate the key rotation process with Azure. We recommend applying their default settings.

1. Go to Set Key Rotation Policy > Not configured from the Create a Key menu.
2. In the Rotation policy, click Enable Auto Rotation.
3. Select Automatically Renew at a Given Time After Creation.

   The default rotation time is set to 18 months.

   

   Warning After key rotation, if required, wait at least 24 hours before deleting or disabling the previous key.

Enable BYOKV in Archive Console

1. Go to the Archive tab.
2. Click Bring Your Own Key.

   If you can't see the Bring Your Own Key button, contact Support to turn on this feature.

3. Enter the Key Identifier of your key.

   Archive doesn't make use of the version.

4. Click Activate.
   If the key is verified, the status changes to In Progress. When completed, the status changes to Active.

   If you can't see the updated status, refresh the browser and reopen the Bring Your Own Key page.

   If the key verification fails, an error message appears.

5. Click Close.

Add or Remove Services from BYOKV

When a region is set up to use BYOK, BYOKMS, or BYOKV, you can add the different services that are available in the Archive Console to the new encrypted region, if these services are assigned to that region. Adding a service moves all the archived data of that service from the general Archive S3 bucket to your dedicated S3 bucket, which is encrypted with your private keys.

1. Click the Action menu (three dots) next to the service name.
2. Select Add to BYOK.
3. Click Enable.
   The service's status changes to In Progress. When completed, the service's status changes to Active.

To remove a service, click the Action menu (three dots) next to the service and select Remove from BYOK.

To remove a region from BYOK, contact Support for assistance.

Note This process removes a service from your BYOK region only, and can be lengthy, depending on the amount of archived records associated with the specific service. You can experience interruptions to the search quality during this time.

Swap from BYOKV to BYOK

If you decide that Bring Your Own Key is a more fitting solution, you can swap to it.

Note Once the switch is confirmed, it cannot be canceled. You will only be able to switch back to BYOKV once the switch to BYOK is complete.

1. Go to the Services page.
2. Click Manage BYOK.
3. Click Switch.
4. Click Switch.
   The switch will only happen after you rotate your key.
5. Click Download Public Key.
6. Run the Mac or Linux sample script to generate a file with the encryption key wrapped by the public key.
7. Under Encrypted Passphrase, click Browse.
8. Select the encrypted passphrase.
9. Under Private Key PKCS12 Archive, click Browse.
10. Select the generated private key file wrapped in the public key.
11. Click Activate.

Set Up BYOK

1. Click Manage BYOK.
   The Manage BYOK page is displayed.
2. To expand the activation section, click the arrow next to the Hosting Region.
3. Click Download Public Key.
4. To generate a binary file with the generated encryption key wrapped by our public key, run the Linux or Mac sample script.
5. In the Wrapped Encryption Key section, click Browse....
6. Select the generated binary file to upload.
7. Click Activate.

   When the key is verified, the status changes to In Progress. When completed, the status changes to Active.

   

   Note If the key verification fails, this error message is displayed:

   Something went wrong while trying to encrypt your data. Please try to add a new key.

8. Click Close.

Add or Remove Services from BYOK

After activating BYOK for a region, you can add services to your encrypted region. All archived data associated with those services is moved from the general Archive S3 bucket to your encrypted S3 bucket.

1. Click the Action menu (three dots) next to the service name.
2. Select Add to BYOK.
3. Click Enable.
   The service's status changes to In Progress during the migration. When completed, the service's status changes to Active.

To remove a service, click the Action menu (three dots) next to the service and select Remove from BYOK.

To remove a region from BYOK, contact Support for assistance.

Note This process can be lengthy, depending on the number of records to be moved. It can take anywhere from several hours to several days. There can be interruptions to the search quality during this time, so select the right time for your org to switch services. You can experience errors in Archive during this period.

Rotate an Encryption Key

1. Click Bring Your Own Key.
2. Click the arrow next to the region with the key you want to rotate.
3. Click Download Public Key.
4. To generate a binary file with the generated encryption key wrapped by the public key, run the Linux or Mac sample script.
5. In the Wrapped Encryption Key section, click Browse....
6. Select the file to upload the generated binary file.
7. Click Rotate.

   If the key is verified, the status changes to Key Rotating. When completed, the status changes to Active.

8. Click Close.

   On the Archive Service page, any services encrypted with the key show the Key Rotating status in the BYOK column. When the rotation is complete, the status changes to Enabled.

Generate Your Own Key in Windows

If you plan to generate the key on a Windows-based machine:

1. Download Git for Windows.
2. Install Git on Windows using the installation wizard.

   The instillation wizard is long. Choose the default in all of the steps.

   The most important one is selecting the OpenSSL library.

3. When GIT is installed, open the Git Bash application.
4. Within Git Bash, follow the instructions for Linux featured on this page.
5. Go to the directory where the two downloaded files, the sample script and the relevant public key, are located.
6. In Git Bash, run this script.

   ./archive-secretgen-linux.sh PublicKey.der

   

   Note The script must have a ./ before the archive-secretgen-linux.sh script and PublicKey.der public key target.

Generate Your Own Key in Linux or Mac

If you plan to generate the key on a Linux or Mac operating system:

1. Select Download Public Key.
2. To generate the required information, download and run a Linux or MacOS sample script.
3. Change the script file to be executable.

   For Linux:

   chmod +x archive-secretgen-linux.sh

   For Mac:

   chmod +x archive-secretgen-macos.sh

4. To create the wrapped encryption key, run one of the Scripts as sudo.

   For Linux:

   ./archive-secretgen-linux.sh PublicKey.der

   For Mac:

   ./archive-secretgen-macos.sh PublicKey.der

   A new file containing the wrapped encryption key is created.

   encrypted_secret.bin

5. Upload the generated file and click Browse.
6. Click Activate.

Revoke an Active Encryption Key

When revoking an active encryption key, all access to data is blocked within 15 minutes.

Warning When you revoke the key, Archive no longer runs, and you can't access your archived data. The Archive package assigned to your account is deactivated.

1. Log in to your Own account as the account owner.
2. Click Manage BYOK.
   The Manage BYOK window shows your connected services per region and their status. The key you want to revoke has an Active status.
3. Click Revoke.
   A warning is displayed, asking you to confirm the revoke action.
4. Enter the word "Revoke" (not case-sensitive) in the space provided.
5. Confirm the revocation by clicking Revoke.

   The Manage BYOK window shows the region as Revoked.

Swap from BYOK to BYOKMS

If you decide that Bring Your Own Key Management System is a more fitting solution, you can swap to it.

Note

• Make sure you have your KMS’s alias ARN before starting the switch process.
• Once the switch is confirmed, it cannot be canceled. You will only be able to switch back to BYOK once the switch to BYOKMS is complete.

1. Go to the Services page.
2. Click Manage BYOK.
3. Click Switch.
4. Click Switch.
   The switch will only happen after you rotate to your key management system.
5. Select the appropriate region from the dropdown list.
6. Enter the KMS Alias you created in AWS.
7. Click Rotate.

Set Up BYOK

1. Go to the Services page.
2. Click Manage BYOK.
3. Click Download Public Key.
4. Under Encrypted Passphrase, click Browse.
5. Select the encrypted passphrase.
6. Under Private Key PKCS12 Archive, click Browse.
7. Select the generated private key file wrapped in the public key.
8. Click Activate.

   If the key is verified, the status changes to In Progress. When completed, the status changes to Active.

   

   Note This process can take 40-60 minutes to complete. If you don't see the updated status, refresh the browser and reopen the Bring Your Own Key page.

   

   Note If the key verification fails, one of these error messages is displayed.

   • No RSA private key found in the PKCS12 archive.
   • The RSA private key is too short, must be at least 2048 bits.
   • Failed to unwrap the passphrase, please verify that it was wrapped correctly.
   • Failed to extract the private key from the PKCS12 archive, please verify that the archive is valid and that the passphrase is correct.
9. Click Close.

   To remove a region from your BYOK, contact Support.

   You can remove the BYOK service from your region and migrate data back to the Archive S3 bucket.

Add or Remove Services from BYOK

After activating BYOK for a region, you can migrate services to your encrypted region. All archived data associated with those services move from the general Archive S3 bucket to your encrypted bucket.

1. Click the Action menu (three dots) next to the service name.
2. Select Add to BYOK.
3. Click Enable.
   The service's status changes to In Progress during the migration. When completed, the service's status changes to Active.

To remove a service, click the Action menu (three dots) next to the service and select Remove from BYOK.

To remove a region from BYOK, contact Support for assistance.

Note This process can be lengthy, depending on the number of records to be moved. There can be interruptions to the search quality during this time, so select the right time for your org to switch services. You can experience errors in Archive during this period.

Rotate an Encryption Key for Azure

When rotating a key, all services under BYOK are automatically rotated. Key rotation is fast as there's no need for re-encrypting of the Elasticsearch key. The rotation takes effect seamlessly and instantaneously.

1. Click Bring Your Own Key.
2. Click the arrow next to the region with the key you want to rotate.
3. Click Download Public Key.
4. Run the Mac or Linux sample script to generate a file with the encryption key wrapped by the public key.
5. In the Encrypted Passphrase section, click Browse and select the file to upload.
6. In the Private Key PKCS12 Archive section, click Browse and select the file to upload.
7. Click Rotate.
   If the key is verified, the status changes to In Progress. When completed, the status changes to Active.
   If you can't see the updated status, refresh the browser and reopen the Bring Your Own Key page.

   The Created On value is updated with the date and time the key was activated.

8. Click Close.

   Any services encrypted with the key on the Archive Service page shows the Key Rotating status in the BYOK column. When the rotation is complete, the status changes to Enabled.

Generate Your Own Key in Windows

In Azure, you must generate an asymmetric key, which consists of two files: one to lock or encrypt the records, and one to unlock or decrypt the cipher text. If you plan to generate the key on a Windows-based machine:

1. Download Git for Windows.
2. Install Git on Windows using the installation wizard.

   The installation wizard is long. Choose the default in all of the steps.

   The most important one is selecting the OpenSSL library.

3. When Git is installed, open the Git Bash application.
4. Within Git Bash, follow the instructions for Linux featured on this page.
5. Go to the directory where the two downloaded files, the sample script and the relevant public key, are located.
6. In Git Bash, run this script.

   ./archive-secretgen-linux.sh PublicKey.der

   

   Note The script must have a ./ before the archive-secretgen-linux.sh script and PublicKey.der public key target.

Generate Your Own Key in Linux or Mac

If you plan to generate the key on a Linux or Mac operating system:

1. Click Download Public Key.
2. To generate the required information, download and run a Linux or MacOS sample script.

   Alternatively, if you have your own process for creating a private key, generate it and then wrap it in our key.

3. Change the script file to be executable.

   chmod +x archive-secretgen-macos-az.sh

4. To create the wrapped encryption key, run one of the Scripts as sudo.

   For Linux:

   ./archive-secretgen-linux-az.sh PublicKey.der

   For Mac:

   ./archive-secretgen-macos-az.sh PublicKey.der

   Two new files containing the wrapped encryption key and passphrase are created.

   Encrypted Passphrase: encrypted_secret.bin
   Private Key PKCS12 Archiver: encrypted_secret.p12

5. Upload the generated files and click Browse.
6. Click Activate.

Revoke an Active Encryption Key

When revoking an active encryption key, all access to data is blocked within 15 minutes.

Warning When you revoke the key, Archive no longer runs, and you can't access your archived data. The Archive package assigned to your account is deactivated.

1. Log in to your Own account as the account owner.
2. Click Manage BYOK.
   The Manage BYOK window shows your connected services per region and their status. The key you want to revoke has an Active status.
3. Click Revoke.
   A warning is displayed, asking you to confirm the revoke action.
4. Enter the word "Revoke" (not case-sensitive) in the space provided.
5. Confirm the revocation by clicking Revoke.

   The Manage BYOK window shows the region as Revoked.

Swap from BYOK to BYOKV

If you decide that Bring Your Own Key Vault is a more fitting solution, you can swap to it.

Note

• Make sure you have your key vault’s key identifier before starting the switch process.
• Once the switch is confirmed, it cannot be canceled. You will only be able to switch back to BYOK once the switch to BYOKV is complete.

1. Go to the Services Page.
2. Click Manage BYOK.
3. Click Switch.
4. Click Switch.
   The switch will only happen after you rotate to your key vault.
5. Enter the Key Identifier of your key.
6. Click Rotate.

Backup Bucket Encryption

Create a Customer-Managed Key in AWS KMS

1. Go to the Key Management Service section in your AWS Console for the region that matches the app server storage region.
2. Create a new key and follow the onscreen instructions.
3. Grant administrative access to users or roles in your org according to your security policies.
4. To let the app access the key, add the corresponding AWS Principal ARN from the App Server Storage Region Locations table.

App Server Storage Region Locations

App Server	AWS Region	Account Numbers	AWS principal ARN
app1	us-east-1	284606693368	arn:aws:iam::284606693368:root
au1	ap-southeast-2	284606693368	arn:aws:iam::284606693368:root
ca1	ca-central-1	284606693368	arn:aws:iam::284606693368:root
emea1	eu-central-1	284606693368	arn:aws:iam::284606693368:root
emea2	eu-central-1	284606693368	arn:aws:iam::284606693368:root
hipaa1	us-east-1	284606693368	arn:aws:iam::284606693368:root
sg1	ap-southeast-1	284606693368	arn:aws:iam::284606693368:root
uk1	eu-west-2	284606693368	arn:aws:iam::284606693368:root
useast2	us-east-1	284606693368	arn:aws:iam::284606693368:root
usgov2	us-gov-west-1	422652744590	arn:aws-us-gov:iam::422652744590:root

Note Cross-region configurations between S3 and AWS KMS aren't supported. For more information, see Key Policies in AWS KMS.

Key Policy Requirements for S3 and Elasticsearch

Your key policies must meet these minimum requirements.

"Statement":[
                {
                    "Sid":"Allow use of the key",
                    "Effect":"Allow",
                    "Principal":{
                    "AWS": "<PRINCIPAL_ARN>"
                    },
                    "Action":[
                    "kms:Encrypt",
                    "kms:Decrypt",
                    "kms:ReEncrypt*",
                    "kms:GenerateDataKey*",
                    "kms:DescribeKey"
                    ],
                    "Resource":"*"
                    },
                    {
                    "Sid":"Allow attachment of persistent resources",
                    "Effect":"Allow",
                    "Principal":{
                    "AWS": "<PRINCIPAL_ARN>"
                    },
                    "Action":[
                    "kms:CreateGrant",
                    "kms:ListGrants",
                    "kms:RevokeGrant"
                    ],
                    "Resource":"*",
                    "Condition":{
                    "Bool":{
                    "kms:GrantIsForAWSResource":"true"
                    }
                }
            ]

Activate the Key in Archive Console

1. Open the Archive tab.
2. Select Bring Your Own Key.
3. Select the appropriate region from the dropdown list.
4. Enter the KMS Alias you created in AWS.
5. Click Activate.
   When the key is verified, the status changes to Active.

   If the key verification fails, you receive an error message and must review the configuration.

Add or Remove Services from BYOK

After activating BYOK for a region, you can add services to your encrypted region. All archived data associated with those services is moved from the general Archive S3 bucket to your encrypted bucket.

1. Click the Action menu (three dots) next to the service name.
2. Select Add to BYOK.
3. Click Enable.

   The service's status changes to In Progress during the migration. When completed, the service's status changes to Active.

Rotate Keys for BYOKMS

1. Rotate the key in AWS KMS.
   For more information, see Rotate AWS KMS Keys.
2. In the Archive Console, go to Bring Your Own Key.
3. Select the region where you rotated the key.
4. Click Rotate.

   When completed, the key status changes to Active. The services encrypted with the key are re-encrypted.

   If you had the BYOK window open during activation, refresh the console to display the updated status.

   

   Note This process can be lengthy, depending on the data volume. Until the rotation is complete, any searches in Archive are limited to data archived before key rotation began. Select the right time for your org to complete the re-encryption process.

Swap from BYOKMS to BYOK

If you decide that Bring Your Own Key is a more fitting solution, you can swap to it.

Note Once the switch is confirmed, it cannot be canceled. You will only be able to switch back to BYOKMS once the switch to BYOK is complete.

1. Go to the Services page.
2. Click Manage BYOK.
3. Click Switch.
4. Click Switch.
   The switch will only happen after you rotate your key.
5. Click Download Public Key.
6. Run the Mac or Linux sample script to generate a binary file with the generated encryption key wrapped by our public key.
7. In the Wrapped Encryption Key section, click Browse...
8. Select the generated binary file to upload.
9. Click Activate.