thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Advanced

Bring Your Own Key (BYOK)

Practice of generating encryption keys on premises (often in an HSM) and importing them into a cloud key management service.

Definition

BYOK gives customers control over key generation and origin while the key is used inside the provider's KMS. Customers can typically delete the imported material to render data unreadable. Hold Your Own Key (HYOK) goes further by keeping keys outside the provider entirely, as with Google Cloud External Key Manager or AWS KMS external key stores.

Example

A bank generates keys in its on-premises HSM and imports them into AWS KMS to encrypt S3 data.

Exam tip

BYOK equals customer-generated key imported to the cloud; HYOK equals key never leaves customer control.

Related terms