Applying EMEK with AWS or GCP KMS Keys on Splunk Cloud Platform

Available Languages

Updated:October 1, 2026
Document ID:SPLK054768

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Enterprise EMEK Key AWS KMS key

Description

When a user wishes to apply an EMEK key to their Splunk Cloud Platform environment, it is vital to note that this encryption applies exclusively to the entire stack. It is not possible to implement this selectively on specific search heads.
 
To ensure this aligns with your data strategy, please first review the official Splunk EMEK Security Documentation to fully understand the feature's parameters.
To help clarify the architecture, here is a quick overview of how these concepts fit together:
  • AWS and GCP: Cloud Service Provider provides the fundamental cloud infrastructure hosting your environment.
  • EMEK (Enterprise Managed Encryption Keys): Splunk's native integration that allows you to manage encryption keys generated specifically within AWS KMS or GCP KMS accounts.
  • BYOK (Bring Your Own Key): A generic term for uploading keys from external, non-AWS or GCP key managers.

 ⚠️ Crucial Note: Splunk Cloud Platform only supports native keys for this feature. Consequently, traditional BYOK is not an option here.


Investigation

Before proceeding with the activation, users should carry out a spot of due diligence to ensure the environment is properly prepped. Please verify the following items within your stack:
  1. Review the Deployment Guide: Carefully go through the guidelines in the Splunk ACS API Key Provisioning Documentation.
  2. Verify Prerequisite Completion: Users must completely finalise the first steps outlined in that manual. This ensures that the key policies and AWS KMS permissions are fully aligned before Splunk Support intervenes.
  3. Confirm Stack Region: Double-check that your AWS KMS key is created in the exact same geographic region where your Splunk Cloud stack is hosted.

Resolution

Once you have successfully executed the initial investigation and provisioning steps, the fourth step is to open a support case to request the final application of the EMEK key to your stack. Please be assured that you do not need to file a separate ticket for EMEK activation; the activation occurs hand in hand with the application process itself.
 
When opening your support case, you will need to provide the Splunk support team with your KMS key metadata. To gather this, please run the AWS CLI command below.
aws kms describe-key --key-id <Your_KMS_Key_ARN> --region <Your_Stack_Region>
⚠️ Note: Before running this command, you must replace with your actual AWS Key Amazon Resource Name, and with the specific AWS region where your stack is hosted (e.g., eu-central-1).
For GCP run the GCP CLI command bellow:
gcloud kms keys describe KEY-NAME --location=REGION --keyring=KEYRING
 
Depending on the sheer volume of data stored in your environment, encrypting the data can take quite a significant amount of time.
 

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles