What Are Customer-Managed Keys (CMK)?
Customer-managed keys are encryption keys that the data owner generates, holds and controls, rather than keys created and retained by the storage or cloud provider. The provider still encrypts the data, but it has to obtain the key from the customer's key manager to read it, and the customer can withdraw that access.
Why customer-managed keys matter
Encryption at rest is close to universal, so what separates one implementation from another is who holds the key. Where the provider generates, stores and applies the key, encryption protects against a stolen disk but not against the provider's own staff, a legal order served on the provider, or an attacker who reaches the provider's control plane with valid credentials.
Customer-managed keys move that control point. The key lives in a system the customer runs, usually a hardware security module or an external key manager, and the storage platform requests it when data is written or read. Withdrawing the key leaves the stored ciphertext unreadable without anyone touching the data itself.
This matters most where a regulator, a contract or a sovereignty requirement asks an organization to demonstrate control rather than assert it. It also creates a real obligation. Lose the keys and the data is unrecoverable, so custody, rotation and escrow become part of the recovery plan rather than an afterthought.
Example: proving the provider cannot read the data
A European bank keeps backup copies with a provider whose infrastructure sits inside the EU, so data residency is already satisfied. During a legal review the bank is asked to show that the provider's staff cannot read those backups. Under provider-managed keys the answer rests on the provider's internal controls and is awkward to evidence. The bank moves to customer-managed keys held in its own HSM: the storage layer requests a key for each read, the bank logs every request, and disabling the key in the HSM ends the provider's ability to decrypt anything. The data has not moved. What changed is who can make it readable.
How customer-managed keys relate to ARTESCA
ARTESCA encrypts data at rest with AES-256 and can apply encryption at the bucket level, so every object in a bucket is covered. Keys are held in an external, KMIP-compatible key management system rather than on the storage itself, which means the platform does not hold both the data and the means to read it.
Key control and retention answer different questions and are usually needed together. S3 Object Lock governs whether an object version can be deleted before its retention date; the key governs whether it can be read at all. An organization meeting a sovereignty or contractual obligation generally needs both, along with a documented rotation and escrow process, since losing custody of a key has the same practical effect as losing the data.
Related terms
- Hardware security module (HSM) — a tamper-resistant device that generates, stores and uses cryptographic keys.
- Data sovereignty — the principle that data is subject to the laws of the jurisdiction governing it.
- Data residency — the geographic location where data is physically stored.
- S3 Object Lock — WORM retention applied to individual object versions by the storage layer.
- Multi-tenancy — one shared storage platform serving tenants that stay isolated from each other.