--- name: hs-crypto-uko-edit-external-keystore-connection title: Editing connection to external keystores description: You can use Unified Key Orchestrator to edit connection to external keystores with the Unified Key Orchestrator UI, or programmatically with the Unified Key Orchestrator. last-updated: 2026-06-16 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/hs-crypto?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Editing connection to external keystores {: #edit-external-keystore-connection} You can use Unified Key Orchestrator to edit connection to external keystores with the Unified Key Orchestrator UI, or programmatically with the Unified Key Orchestrator. {: shortdesc} You can edit the connection to keystores that are external to your service instance on IBM Cloud®, or from other cloud providers such as Microsoft Azure Key Vault, Amazon Web Services (AWS) Key Management Service (KMS), and Google Cloud KMS. ## Editing connection to external keystores with the UI {: #edit-external-keystore-connection-ui} {: ui} You can only change the keystore name and connection properties one by one. {: tip} To edit the connection to an external keystore by using the UI, complete the following steps: 1. [Log in to the Hyper Protect Crypto Services instance](https://cloud.ibm.com/login){: external}. 2. Click **Keystores** from the navigation to view all the available keystores. 3. Click the external keystore that you want to edit. The Details side panel is displayed. 4. Click **Edit** in each property card to update keystore properties. Because the keystore connection is already established, you cannot make changes to identifying properties that are marked with a Lock icon. {: note} | Property | Description | |-----------------------------|-----------------------------------------------------------| | Keystore name | A unique, human-readable name for easy identification of your keystore, with 1–100 characters in length. The first character must be a letter (case-sensitive) or digit (0–9). The rest can also be symbols (.-_) or spaces. | | Description | (Optional) An extended description for your keystore, with up to 200 characters in length. | | Region on AWS | Read only. The geographical location where the AWS keystore is located in. You cannot edit this property after the keystore is connected. | | Access key ID on AWS | All requests to AWS KMS must be signed by using an access key ID and a secret access key. For more information, see [Understanding and getting your AWS credentials](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html). | | Secret access key on AWS | All requests to AWS KMS must be signed by using an access key ID and a secret access key. The secret access key is available for download only when you create it. | {: #table-1} {: caption="AWS Key Management Service properties" caption-side="bottom"} {: tab-title="AWS keystore"} {: tab-group="External keystore properties"} {: class="comparison-tab-table"} | Property | Description | |-----------------------------|-----------------------------------------------------------| | Keystore name | A unique, human-readable name for easy identification of your keystore, with 1–100 characters in length. The first character must be a letter (case-sensitive) or digit (0–9). The rest can also be symbols (.-_) or spaces. | | Description | (Optional) An extended description for your keystore, with up to 200 characters in length. | | Service name on Azure | Read only. The name must match the name of the Key Vault in Azure. You cannot edit this property after the keystore is connected. | | Resource group name on Azure | Read only. A logical construct that groups multiple resources together. Obtain it from the Azure portal. You cannot edit this property after the keystore is connected. | | Service principal password on Azure | Only password based authentication is supported for service principals. | | Service principal client ID on Azure | Application ID that identifies the application of service principal. | | Subscription ID on Azure | Read only. A GUID that uniquely identifies your subscription to use Azure services. You cannot edit this property after the keystore is connected. | | Tenant ID on Azure | Read only. A tenant is the organization that owns and manages a specific instance of Microsoft cloud services. Use Microsoft Entra ID for authenticating requests to the key vault. You cannot edit this property after the keystore is connected. | {: #table-2} {: caption="Azure Key Vault properties" caption-side="bottom"} {: tab-title="Azure Key Vault"} {: tab-group="External keystore properties"} {: class="comparison-tab-table"} | Property | Description | |-----------------------------|-----------------------------------------------------------| | Keystore name | A unique, human-readable name for easy identification of your keystore, with 1–100 characters in length. The first character must be a letter (case-sensitive) or digit (0–9). The rest can also be symbols (.-_) or spaces. | | Keystore description | (Optional) An extended description for your keystore, with up to 200 characters in length. | | Upload JSON key file | The private key file that is downloaded from your service account on Google Cloud in step 2 of [Setting up required user access in Google Cloud KMS](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-connect-external-keystores&format=markdown#connect-external-keystores-access-google-cloud). The file type must be `.json` and the maximum file size is 4 KB. | | Project on Google Cloud | Read only. The name of your Google Cloud project. It is automatically extracted from the JSON key file that you upload. You cannot edit this property after the keystore is connected. | | Location on Google Cloud | The geographical region where you want to store your Google Cloud KMS resources. You cannot edit this property after the keystore is connected. For more details about the location, see [Google Cloud KMS locations](https://cloud.google.com/kms/docs/locations){: external}. | | Key ring on Google Cloud | A human-readable name of the key ring that organizes your keys. The name must be unique within a location. You cannot edit this property after the keystore is connected. For more information about key rings, see [Key rings](https://cloud.google.com/kms/docs/resource-hierarchy#key_rings){: external}. | | Private key ID on Google Cloud | Read only. The ID of the public/private RSA key pair in Google. It is used for establishing a secure connection to Google Cloud Platform. It is automatically extracted from the JSON key file that you upload. You cannot edit this property after the keystore is connected. | {: #table-3} {: caption="Google Cloud KMS keystore properties" caption-side="bottom"} {: tab-title="Google Cloud KMS keystore"} {: tab-group="External keystore properties"} {: class="comparison-tab-table"} | Property | Description | |-----------------------------|-----------------------------------------------------------| | Keystore name | A unique, human-readable name for easy identification of your keystore, with 1–100 characters in length. The first character must be a letter (case-sensitive) or digit (0–9). The rest can also be symbols (.-_) or spaces. | | Description | (Optional) An extended description for your keystore, with up to 200 characters in length. | | Key Protect API endpoint | Read only. The service endpoint of your Key Protect instance in the format of `https://.kms.cloud.ibm.com`. You cannot edit this property after the keystore is connected. For more information, see [Regions and endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regions&format=markdown). | | IBM Cloud Identity and Access Management endpoint | Read only. The endpoint of IAM, which is `https://iam.cloud.ibm.com`. You cannot edit this property after the keystore is connected. | | Service instance ID on IBM Cloud | Read only. The unique identifier that is assigned to your Key Protect service instance. You cannot edit this property after the keystore is connected. For more information, see [Retrieving your instance ID and cloud resource name](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID&format=markdown). | | Service ID API key | A unique code that is passed to an API to identify the calling application. For more information, see [Managing service ID API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys&format=markdown). | {: #table-4} {: caption="IBM Key Protect keystore properties" caption-side="bottom"} {: tab-title="IBM Key Protect keystore"} {: tab-group="External keystore properties"} {: class="comparison-tab-table"} | Property | Description | |-----------------------------|-----------------------------------------------------------| | Keystore name | A unique, human-readable name for easy identification of your keystore, with 1–100 characters in length. The first character must be a letter (case-sensitive) or digit (0–9). The rest can also be symbols (.-_) or spaces. | | Description | (Optional) An extended description for your keystore, with up to 200 characters in length. | | Hyper Protect Crypto Services API endpoint | Read only. The service endpoint of your Hyper Protect Crypto Services instance in the format of `https://.uko..hs-crypto.appdomain.cloud`. You can get the `` and `` in your provisioned service instance UI dashboard through **Overview** > **Connect** > **Unified Key Orchestrator endpoint URL**. You cannot edit this property after the keystore is connected. | | IBM Cloud Identity and Access Management endpoint | Read only. The endpoint of IAM, which is `https://iam.cloud.ibm.com`. You cannot edit this property after the keystore is connected. | | Service instance ID on IBM Cloud | Read only. The unique identifier that is assigned to your service instance. You cannot edit this property after the keystore is connected. For more information, see [Retrieving your instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID&format=markdown). | | Service ID API key | A unique code that is passed to an API to identify the calling application. For more information, see [Managing service ID API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys&format=markdown). | {: #table-5} {: caption="IBM Cloud KMS keystore properties" caption-side="bottom"} {: tab-title="IBM Cloud KMS keystore in another instance"} {: tab-group="External keystore properties"} {: class="comparison-tab-table"} 5. Click **Save** to save the changes. You can search for a specific keystore by using the search bar, or filter keystores based on your needs by clicking the **Filter** icon ![Filter icon](../icons/filter.svg "Filter") in the **Keystores** table. {: tip} ## Editing connection to external keystores with the API {: #edit-external-keystore-connection-api} {: api} To edit the connection to an external keystore through the API, follow these steps: 1. [Retrieve your service and authentication credentials to work with keystores in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api&format=markdown). 2. Edit the connection to an external keystore by making a `PATCH` call to the following endpoint. ``` https://.uko..hs-crypto.appdomain.cloud/api/v4/keystores/ ``` {: codeblock} Replace `` with the ID of your keystore. For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/uko#update-keystore){: external}. ## What's next {: #edit-external-keystore-connection-next} - To find out how to connect to an external keystore, check out [Connecting to external keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-connect-external-keystores&format=markdown). - To find out how to disconnect from an external keystore, check out [Disconnecting from external keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disconnect-external-keystores&format=markdown).