# Protect the Configuration with AWS Key Management Service

Amazon AWS Key Management Service can be utilized on an EC2 instance hosting Keeper Commander in order to protect and store the configuration data.

The AWS Key Management Service protected storage resource URL format is as follows:

```
aws-kms://<KEY-REGION>/<KEY ID or ALIAS>
```

**Example**:

`aws-kms://us-east-1/12345678-abcd-1234-dcba-123456789012`

`aws-kms://eu-west-1/alias/key`

The secret name should contain URL-safe characters

Keeper Commander requires the "key users policy" to be granted to AWS user or role.