Skip to content
External Key Management Service › Field Encryption › Encryption
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Configuring External Key Management Service

Set up External Key Management Service (EKMS) to control the encryption of your ServiceNow data using your Amazon Web Service Key Management System (AWS KMS).

Configuration Overview

Configuring External Key Management Service (EKMS) involves installing the plugin, connecting to AWS KMS, and setting up encryption for specific fields. Complete these tasks to establish external key management for your ServiceNow data.

Configuration Workflow

  1. Activate the EKMS plugin and assign required user roles
  2. Configure the AWS KMS key definition with connection credentials
  3. Create cryptographic modules that use external key wrapping
  4. Specify which table fields should be encrypted
  5. Set up access policies to control data visibility
  6. Test encryption and access control to verify the configuration

Prerequisites

Before configuring EKMS, verify that you have:

  • AWS KMS access through your organization's request process
  • Created or identified an AWS KMS key
  • Identity and Access Management (IAM) user credentials with KMS permissions
  • IAM user configured with at least these permissions: kms:DescribeKey, kms:Encrypt, and kms:Decrypt

  • admin, security_admin, and sn_kmf.cryptographic_manager roles in ServiceNow

  • Activate External Key Management Service
    Install the External Key Management Service (EKMS) plugin and configure user permissions to enable external key management functionality.

  • Configure an external key definition
    Configure your external encryption key to use in External Key Management Service (EKMS).
  • Create a cryptographic module with external key wrapping
    Create a cryptographic module that uses external Amazon Web Services Key Management System (AWS KMS) key wrapping to encrypt ServiceNow data.
  • Create Encrypted Field Configurations
    Configure specific fields to be encrypted using your External Key Management Service (EKMS) cryptographic module with external Amazon Web Services Key Management System (AWS KMS) key wrapping.
  • Set up Module Access Policies
    Configure module access policies in External Key Management Service (EKMS) to control who can view encrypted data in clear text.
  • Test an external key definition
    Test your external encryption key to use in External Key Management Service (EKMS).

Parent Topic:External Key Management Service

Related topics

External Key Management Service

Activate External Key Management Service

Configure an external key definition

Create a cryptographic module with external key wrapping

Create Encrypted Field Configurations