# Gateway Configuration with AWS KMS
## **Overview**
If the Keeper Gateway is installed on an AWS EC2 Instance, the corresponding Gateway configuration file can be protected and stored in AWS Secrets Manager. This method eliminates the need for storing a configuration file on the instance, and instead stores the configuration file with AWS KMS protection.
### **AWS Key Management Service (KMS) Key**
AWS KMS is a fully managed service that makes it easy for you to create and control the cryptographic keys used to encrypt and decrypt your data. The service is integrated with other AWS services, making it easier to encrypt data and manage keys. You will need a AWS KMS key as part of this process, and it is recommended that you follow the principle of least privilege when assigning permissions to this key.
### Prerequisites
In order to use AWS KMS to protect the Gateway configuration secrets, you need to install the Keeper Gateway on an EC2 instance which assumes an IAM Role. This works on either Docker or Linux install methods.
* [Docker Installation](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/gateways/gateway-with-docker)
* [Linux Installation](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/gateways/linux-installation)
### Generate a Configuration
From the Keeper Vault, go to **Secrets Manager** > **Applications** and select the application configured with your Gateway. Then select the Gateways tab and select "Provision Gateway".
Select the Gateway initialization method of "Configuration" and click Next.
Select Configuration Method
Copy the Base64 Configuration
Alternatively, you can generate a One-Time Access Token and then use the Keeper Gateway's "gateway ott-init" command:
```
gateway ott-init [ONE-TIME-TOKEN]
```
In either case, you'll be provided with a base64 encoded configuration. Save this for the next step.
### Create Secret in AWS Secrets Manager
From the AWS Console, go to the Secrets Manager and create a new secret.
* Select "Other type of secret"
* Select Plaintext and paste the entire base64 value there.
* Click **Next**.
Create Secret using Plaintext formatting
Enter a **Secret Name** and a description then click **Next**, **Next** and **Store**.
Secret Name and Description
View Secrets
### Assign Policy to Instance Role
The EC2 instance role needs to be assigned a policy which provides read access to the specific AWS Secrets Manager key. As an example:
```
{
"Sid": "SecretsManagerPermissions",
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue"
],
"Resource": "arn:aws:secretsmanager:us-west-1:XXX:secret:XXX"
}
```
### Confirming Access
From the EC2 instance, the below command will confirm the policy has been applied:
{% code overflow="wrap" %}
```
aws secretsmanager get-secret-value --secret-id YourSecretName --query SecretString --output text
```
{% endcode %}
### Configuration of the Keeper Gateway
#### Docker Install Method
For Docker installations, remove the `GATEWAY_CONFIG` entry and add `AWS_KMS_SECRET_NAME` with the value containing the name of the secret from the AWS secrets manager.
```
services:
keeper-gateway:
platform: linux/amd64
image: keeper/gateway:latest
shm_size: 2g
security_opt:
- seccomp:./docker-seccomp.json
- apparmor=./guacd-apparmor-profile
environment:
ACCEPT_EULA: Y
AWS_KMS_SECRET_NAME: "YourSecretName"
```
Then update the service with the new environment:
```
docker compose pull
docker compose down
docker compose up -d
```
#### Linux Install Method
Open the Keeper Gateway service unit file:
`/etc/systemd/system/keeper-gateway.service`
Modify the "ExecStart" line as seen below, replacing YourSecretName with your assigned name.
{% code overflow="wrap" %}
```
ExecStart=/bin/bash -c "/usr/local/bin/gateway start --service --aws-kms-secret-name="YourSecretName" --log-to-stdout"
```
{% endcode %}
Apply changes to the service:
```
sudo systemctl daemon-reload
sudo systemctl restart keeper-gateway
```
If there are any errors starting up, they can be seen through this command:
```
systemctl status keeper-gateway.service
```
