DuoKey for AWS XKS
External Key Store product sheet. 4 pages.
How to keep the root key for AWS data outside Amazon using the AWS KMS External Key Store. Applications keep calling AWS KMS, and KMS forwards key operations to DuoKey. It covers envelope encryption, Kubernetes deployment, and which AWS services work without changes. Download it for the architecture diagram and a clear answer to "can AWS decrypt our data?"
Get the download
Tell us where to send the link. A business email is required.
"Customer-managed" keys in AWS KMS are still generated and held by AWS. If your regulator asks whether Amazon can decrypt your data at rest, the honest answer today may be yes.
The AWS External Key Store changes that answer. AWS KMS calls a key manager you control, and DuoKey keeps the root key outside AWS, split with multi-party computation. Your applications keep calling KMS as before.
The sheet walks through envelope encryption, the Kubernetes deployment, and which AWS services work without changes. Download it if you need to answer FINMA, GDPR, or your own board with a clear no.
FAQ
Who is this for?
AWS architects and security teams who need key material that AWS cannot access.
Do applications need code changes?
Most AWS services that support customer-managed KMS keys work without configuration or code changes.
Where does the key sit?
Outside AWS. DuoKey splits it with multi-party computation, so AWS never has any of the key material.
Is it a deployment guide?
No. It is a 4-page overview, which shows the architecture. For step-by-step setup, please refer to DuoKey Documentation at docs.duokey.com.