<a id="use-ccloud-cli-with-encrypted-clusters"></a>

# Use Confluent CLI with Self-Managed Encryption Keys on Confluent Cloud

You can use the Confluent CLI to create, delete, describe, and list self-managed
encryption keys (aka BYOK) for Dedicated, Enterprise, and AWS Freight Kafka clusters on Confluent Cloud . The sections
below provide examples of how to use these Confluent CLI commands to manage your
self-managed encryption keys.

* For Confluent Cloud on AWS and Azure, you can use the Confluent CLI [confluent byok](https://docs.confluent.io/confluent-cli/3.3/command-reference/byok/)
  commands to create, delete, describe, and list self-managed encryption keys for Dedicated, Enterprise, and AWS Freight Kafka clusters.
* For Confluent Cloud on Google Cloud, you can use the Confluent CLI `confluent kafka cluster create` command
  with the `--byok` flag to create Dedicated Kafka clusters that use self-managed
  encryption keys. For details, see [confluent kafka cluster create](https://docs.confluent.io/confluent-cli/current/command-reference/kafka/cluster/confluent_kafka_cluster_create.html).

## Before you begin

To use the examples, make sure that you meet the following prerequisites:

* Confluent CLI (v3.3.0 or later) is installed. See [Install Confluent CLI](https://docs.confluent.io/ccloud-cli/current/install.html).
* Sign in to Confluent CLI. See [Connect Confluent CLI to Confluent Cloud Cluster](https://docs.confluent.io/confluent-cli/current/connect.html).
* Create a KMS, or customer-managed, key in your cloud provider account.

## Register an encryption key

Before you can create an encrypted cluster, you must register a self-managed key with Confluent Cloud.

To register an encryption key for use with a self-managed encrypted Kafka cluster, use the
`confluent byok create` command.

### AWS

1. Using the AWS CLI, run the `aws kms list-keys` command to get the
   ARN of the KMS (customer-managed) key in your AWS account.
   ```shell
   aws kms list-keys
   ```

   For more information, see [Viewing KMS keys with the API](https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys-cli.html#viewing-keys-list-keys).
2. Note the ARN of the key you want to use for encryption.
3. Using the Confluent CLI , run the `confluent byok create` command
   to register the encryption key with Confluent Cloud.
   ```shell
   confluent byok create arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012
   ```

   For more information, see [confluent byok create](https://docs.confluent.io/confluent-cli/current/command-reference/byok/confluent_byok_create.html).

After successfully registering the encryption key, you can use it to create a
Dedicated, Enterprise, or Freight Kafka cluster that uses a self-managed key for encryption. For steps
on creating a Dedicated, Enterprise, or Freight Kafka cluster that uses a self-managed key for encryption,
see [Encrypt a Dedicated Cluster using Self-managed Keys on AWS](byok-aws.md#byok-encrypted-clusters-aws).

### Azure

1. Using the Azure CLI, run the `az keyvault show` command to get the
   Key Vault URL of the customer-managed key in your Azure Key Vault.
   ```shell
   az keyvault show --name <key-vault-name> --resource-group <resource-group-name> --query "properties.vaultUri" -o tsv
   ```

   For more information, see [az keyvault show](https://learn.microsoft.com/en-us/cli/azure/keyvault?view=azure-cli-latest#az-keyvault-show).
2. Note the Azure Key Vault URL for the key you want to use for encryption.
3. Using the Confluent Cloud CLI, run the `confluent byok create` command to
   register the encryption key with Confluent Cloud.
   ```shell
   confluent byok create https://vault-name.vault.azure.net/keys/key-name --key-vault /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resourcegroup-name/providers/Microsoft.KeyVault/vaults/vault-name --tenant 00000000-0000-0000-0000-000000000000
   ```

   For more information, see [confluent byok create](https://docs.confluent.io/confluent-cli/current/command-reference/byok/confluent_byok_create.html).

> After successfully registering the encryption key, you can use it to create a
> Dedicated or Enterprise Kafka cluster that uses a self-managed key for encryption. For steps
> on creating a Dedicated or Enterprise Kafka cluster that uses a self-managed key for encryption,
> see [Encrypt Cluster using Self-managed Keys on Azure](byok-azure.md#create-dedicated-cluster-with-encryption-azure).

## Delete a self-managed key from Confluent Cloud

To delete a self-managed key from Confluent Cloud, use the `confluent byok delete` command.

```shell
confluent byok delete <cck-id>
```

For more information, see [confluent byok delete](https://docs.confluent.io/confluent-cli/current/command-reference/byok/confluent_byok_delete.html).

## Describe a self-managed key

To describe a self-managed key, use the `confluent byok describe` command.

```shell
confluent byok describe <key-id>
```

For more information, see [confluent byok describe](https://docs.confluent.io/confluent-cli/current/command-reference/byok/confluent_byok_describe.html).

## List self-managed keys

To list all self-managed keys, use the Confluent CLI `confluent byok list` command. The output
includes the `cck-id`, provider (`aws` or `az`), and state (`in-use` or `available`).

```shell
confluent byok list
```

For more information, see [confluent byok list](https://docs.confluent.io/confluent-cli/current/command-reference/byok/confluent_byok_list.html).