---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Create a cryptographic module with external key wrapping

# Create a cryptographic module with external key wrapping {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Create a cryptographic module that uses external Amazon Web Services Key Management System (AWS KMS) key wrapping to encrypt ServiceNow data.

## Vorbereitungen

Roles required: admin, security_admin, and sn_kmf.cryptographic_manager

Confirm that you have:

* [Completed EKMS plugin activation](https://servicenow-prod.fluidtopics.net/AqWBOuoYCxt08eZyLfOqRQ "Install the External Key Management Service (EKMS) plugin and configure user permissions to enable external key management functionality.")
* [Configured the EKMS key definition with valid AWS credentials](https://servicenow-prod.fluidtopics.net/ljQ3vNp3pALVUrun2sAIIw "Configure your external encryption key to use in External Key Management Service (EKMS).")
* [Verified the connection test passed successfully](https://servicenow-prod.fluidtopics.net/F6NOlVR3x7kGZrGmUHku~Q "Test your external encryption key to use in External Key Management Service (EKMS).")
{#create-cryptographic-module-external-key-wrapping__ul_xz2_dch_g3c}

## Warum und wann dieser Vorgang ausgeführt wird

A cryptographic module with external key wrapping generates encryption keys that are wrapped (encrypted) by your AWS KMS key instead of ServiceNow's internal key management. ServiceNow can't decrypt your data without access to your external AWS key.

## Prozedur

1. Navigate to AllSystem SecurityField Encryption Modules.
2. Select New.
3. Enter a name for the module in the Name field.
4. Select the External wrap key check box.  
   Wichtig:  
   If Externally Wrap Key isn't selected, the module uses internal key wrapping, which doesn't use your AWS KMS key.
5. In the External KMS Configuration field, enter or use the search function to select your EKMS configuration.
6. Select Submit to save the cryptographic module.
{#create-cryptographic-module-external-key-wrapping__steps_zz2_dch_g3c}

## Ergebnisse

The cryptographic module is created and ready to be used for encrypting field data. The encryption key is wrapped by your AWS KMS key, establishing external key management.

When you enable external key wrapping, all keys for this module are automatically rewrapped with your External Key Encryption Key (EKEK). This protects them with your EKMS key. Both existing keys and future keys you create
will be externally wrapped.

## Nächste Maßnahme

Next steps:

* [Create encrypted field configurations to specify which tables and columns to encrypt](https://servicenow-prod.fluidtopics.net/bXF45FU2G8xLBqmkMqrRyQ "Configure specific table fields to be encrypted using your External Key Management Service (EKMS) cryptographic module with external Amazon Web Services Key Management System (AWS KMS) key wrapping.")
* [Set up module access policies to control who can view the encrypted data](https://servicenow-prod.fluidtopics.net/nBRMQAtk04wAF4Jhfpr2uw "Define which user roles can view encrypted data in clear text by configuring module access policies for External Key Management Service (EKMS).")
{#create-cryptographic-module-external-key-wrapping__ul_e1f_dch_g3c}