> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/server/security/encryption/data-at-rest-encryption/key-management-and-encryption-plugins.md).

# Key Management and Encryption Plugins

{% columns %}
{% column %}
{% content-ref url="/pages/V0DCFbIpTJX7Crk0HtA5" %}
[Encryption Key Management](/docs/server/security/encryption/data-at-rest-encryption/key-management-and-encryption-plugins/encryption-key-management.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Overview of key management in MariaDB, discussing the need for plugins to manage encryption keys, support for multiple keys (ID 1 for system, ID 2 for temp), and key rotation capabilities.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/kEr5f1qfVXItTlF97e6c" %}
[File Key Management Encryption Plugin](/docs/server/security/encryption/data-at-rest-encryption/key-management-and-encryption-plugins/file-key-management-encryption-plugin.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Details the File Key Management plugin, which reads encryption keys from a plain-text (or encrypted) file, serving as a simple solution or reference implementation for data-at-rest encryption.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/NpmRdA6DvxLcx0BPZGLf" %}
[AWS Key Management Encryption Plugin](/docs/server/security/encryption/data-at-rest-encryption/key-management-and-encryption-plugins/aws-key-management-encryption-plugin.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Introduction to the AWS Key Management plugin, which uses Amazon KMS to generate and store master keys, decrypting them at startup to enable data-at-rest encryption with key rotation support.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/NBKBBEWqkQm5ZVNbx7VB" %}
[Amazon Web Services (AWS) Key Management Service (KMS) Encryption Plugin Advanced Usage](/docs/server/security/encryption/data-at-rest-encryption/key-management-and-encryption-plugins/aws-key-management-encryption-plugin-advanced-usage.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Step-by-step tutorial for setting up the AWS KMS plugin, covering the creation of a Customer Master Key (CMK) in AWS, configuring IAM roles for EC2, and installing the plugin from source.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/xiMQR5BPBqT1csFjkLUu" %}
[Amazon Web Services (AWS) Key Management Service (KMS) Encryption Plugin Setup Guide](/docs/server/security/encryption/data-at-rest-encryption/key-management-and-encryption-plugins/aws-key-management-encryption-plugin-setup-guide.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Advanced configuration guide for the AWS KMS plugin, detailing how to secure key access using IAM policies, restrict usage by IP address, and implement Multi-Factor Authentication (MFA).
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/uVRM1aizdqv4Hqbp2Nfz" %}
[Hashicorp Key Management Plugin](/docs/server/security/encryption/data-at-rest-encryption/key-management-and-encryption-plugins/hashicorp-key-management-plugin.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Guide to using the HashiCorp Key Management plugin, which integrates MariaDB with HashiCorp Vault for centralized, secure key storage and lifecycle management.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/yEDCHzyBi3Fyok0jyVyA" %}
[Uninstall Key Management Plugins](/docs/server/security/encryption/data-at-rest-encryption/key-management-and-encryption-plugins/uninstall-key-management-plugins.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Final step of removing key management plugins from the configuration once all data and logs have been confirmed as unencrypted.
{% endcolumn %}
{% endcolumns %}