> For the complete documentation index, see [llms.txt](https://docs.envector.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.envector.io/1.5.x/key-management/client-managed-keys/aws-key-storage.md).

# AWS-Backed Key Storage

In the client-managed model you can delegate long-term key custody to AWS instead of the local filesystem. When enabled, key material is generated **in memory** and stored across two AWS services:

* **Amazon S3** — `EncKey.json` and `EvalKey.json` (public keys) are stored as objects.
* **AWS Secrets Manager** — `SecKey.json` and `MetadataKey.json` (secret keys) are stored as encrypted secrets.

No key files are written to the local disk.

> This is a **client-side** storage backend for the [client-managed](/1.5.x/key-management/client-managed-keys.md) key model. It is unrelated to the enVector [Managed KMS](/1.5.x/key-management/key-management.md), whose own secret store is a Secret Manager (Vault/OpenBao). Choose one model per deployment.

## Before you begin

* The target AWS **region** and **S3 bucket** exist and are provided via `region_name` and `bucket_name`.
* A **Secrets Manager prefix** (optional, e.g. `envector/keys/`) is chosen to namespace multiple key sets.
* AWS credentials are configured for an IAM principal that can:
  * S3: `PutObject` / `GetObject` / `DeleteObject` on the bucket
  * Secrets Manager: `CreateSecret` / `DescribeSecret` / `GetSecretValue` / `PutSecretValue`

## Enabling AWS storage

Set `key_store="aws"` and provide the AWS resource parameters at initialize time (instead of `key_path`). See [Key Configuration](/1.5.x/sdk-user-guide/initialize/key-config.md) for the full parameter list.

| Parameter         | Description                                              |
| ----------------- | -------------------------------------------------------- |
| `key_store="aws"` | Switch from filesystem (`"local"`) to AWS-backed storage |
| `key_id`          | Identifier for the key set (required)                    |
| `region_name`     | AWS region (required)                                    |
| `bucket_name`     | S3 bucket for public keys (required)                     |
| `secret_prefix`   | Secrets Manager prefix for Sec/Metadata keys (optional)  |

> **Sealing is not supported in AWS mode.** Keep `seal_mode="none"` and omit `seal_kek_path` / `seal_key_stdin`, otherwise an error is raised. AWS mode always generates keys in memory via `generate_keys_stream()`, so local output directories are skipped.

## CLI

```bash
pyenvector-keygen \
    --key_store aws \
    --key_id aws-example \
    --region_name ap-northeast-2 \
    --bucket_name my-envector-key-bucket \
    --secret_prefix envector/keys/
```

This generates a key set in memory and uploads it to AWS — public keys as S3 objects, secret keys as encrypted Secrets Manager entries. `--key_id`, `--region_name`, and `--bucket_name` are mandatory; `--secret_prefix` is optional. Other generation parameters (`--dim`, `--preset`, `--eval_mode`, `--metadata_encryption`) work the same as local generation.

## Python

Generate a key set and upload it with `KeyManager(key_store="aws")`:

```python
import pyenvector as ev
from pyenvector.crypto import KeyGenerator, KeyManager

keygen = KeyGenerator(key_id="aws-example", dim_list=512)
key_dict = keygen.generate_keys_stream()

manager = KeyManager(
    key_id="aws-example",
    key_store="aws",
    region_name="ap-northeast-2",
    bucket_name="my-envector-key-bucket",
    secret_prefix="envector/keys/",
)

manager.save(key_dict)
print("Keys for 'aws-example' uploaded to AWS")

loaded_key_dict = manager.load()
print("Keys for 'aws-example' loaded from AWS")
```

When you initialize the client with `key_store="aws"` and `auto_key_setup=True`, the SDK auto-generates, uploads, registers, and loads keys — or fetches the existing blobs if the key already lives in AWS. This keeps secret material out of the local filesystem while preserving the same ergonomics as the default `key_path` workflow.

## Related

* [Key Configuration](/1.5.x/sdk-user-guide/initialize/key-config.md) — the init-time parameters
* [Key Generation](/1.5.x/key-management/client-managed-keys/key-generation.md) — local key generation and sealing
* [Key Registration & Deletion](/1.5.x/key-management/client-managed-keys/key-registration.md) — server-side key activation


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.envector.io/1.5.x/key-management/client-managed-keys/aws-key-storage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.