Before you can use Bring Your Own Key (BYOK) with AWS, you will need to configure AWS to communicate with the Cryptographic Security Platform Vault. You can use symmetric or asymmetric keys for encryption and decryption. All key types are supported.

If you plan to use on-demand key rotation, only AES keys are supported.