--- name: key-protect-integrate-services title: Integrating services description: encryption keys is sometimes called Bring Your Own Key (BYOK). last-updated: 2026-08-10 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/key-protect?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. {:shortdesc: .shortdesc} {:screen: .screen} {:pre: .pre} {:table: .aria-labeledby="caption"} {:external: target="_blank" .external} {:codeblock: .codeblock} {:tip: .tip} {:note: .note} {:important: .important} {:term: .term} # Integrating services {: #integrate-services} IBM® Key Protect for IBM Cloud® integrates with a number of IBM Cloud services to enable encryption with customer-managed keys for those services. Encryption with customer-managed encryption keys is sometimes called Bring Your Own Key (BYOK). {: shortdesc} ## Database service integrations {: #database-integrations} You can integrate Key Protect with the following **database** services. | Service | Description | Links | | ------- | ----------- | ----- | | [IBM Cloudant for IBM Cloud (IBM Cloud Dedicated)](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-creating-and-leveraging-an-ibm-cloudant-dedicated-hardware-plan-instance-on-ibm-cloud&format=markdown){: external} | IBM Cloudant is a document-oriented database as a service (DBaaS). It stores data as documents in JSON format. | [View docs](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-securing-your-data-in-cloudant&format=markdown){: external} | | [IBM Cloud Databases for Elasticsearch](https://cloud.ibm.com/docs/databases-for-elasticsearch?format=markdown){: external} | IBM Cloud Databases for Elasticsearch is a managed Elasticsearch service that is hosted in the IBM Cloud and integrated with other IBM Cloud services. | [View docs](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui&format=markdown){: external} | | [IBM Cloud Databases for MongoDB](https://cloud.ibm.com/docs/databases-for-mongodb?format=markdown){: external} | IBM Cloud Databases for MongoDB is a managed MongoDB service that is hosted in the IBM Cloud and integrated with other IBM Cloud services. | [View docs](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui&format=markdown){: external} | | [Databases for MySQL](https://cloud.ibm.com/docs/databases-for-mysql?format=markdown){: external} | IBM Cloud Databases for MongoDB is a managed MySQL service that is hosted in the IBM Cloud and integrated with other IBM Cloud services. | [View docs](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui&format=markdown){: external} | | [IBM Cloud Databases for PostgreSQL](https://cloud.ibm.com/docs/databases-for-postgresql?format=markdown){: external} | IBM Cloud Databases for PostgreSQL is a managed PostgreSQL service that is hosted in the IBM Cloud and integrated with other IBM Cloud services. | [View docs](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui&format=markdown){: external} | | [IBM Cloud Databases for Redis](https://cloud.ibm.com/docs/databases-for-redis?format=markdown){: external} | IBM Cloud Databases for Redis is a managed service that is hosted in the IBM Cloud and integrated with other IBM Cloud services. | [View docs](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui&format=markdown){: external} | | [IBM Cloud Messages for RabbitMQ](https://cloud.ibm.com/docs/messages-for-rabbitmq?format=markdown){: external} | IBM Cloud Messages for RabbitMQ is a managed RabbitMQ service that is hosted in the IBM Cloud and integrated with other IBM Cloud services. | [View docs](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui&format=markdown){: external} | | [IBM Db2 as a Service](https://cloud.ibm.com/docs/Db2onCloud?format=markdown){: external} | IBM Db2 as a Service is an SQL database that is provisioned for you in the cloud. You can use IBM Db2 SaaS just as you would use any database software, but without the time and expense of hardware setup or software installation and maintenance. | [View docs](https://cloud.ibm.com/docs/Db2onCloud?topic=Db2onCloud-key-management-services&format=markdown){: external} | {: caption="Supported database services." caption-side="bottom"} ## Storage service integrations {: #storage-integrations} You can integrate Key Protect with the following **storage** services. | Service | Description | Integration docs | | ------- | ----------- | ---------------- | | [Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown){: external} | You can use Block Storage for VPC to provide hypervisor-mounted, high-performance data storage for virtual server instances in your VPC. | [View docs](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-about&format=markdown#vpc-customer-managed-encryption){: external} | | [IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage&format=markdown){: external} | You can use IBM Cloud Object Storage to store unstructured data in the IBM Cloud. | [View docs](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-kp&format=markdown){: external} | {: caption="Supported storage services." caption-side="bottom"} ## Compute service integrations {: #compute-integrations} You can integrate Key Protect with the following **compute** services. | Service | Description | Integration docs | | ------- | ----------- | ---------------- | | [IBM Cloud image templates](https://cloud.ibm.com/docs/image-templates?topic=image-templates-getting-started-with-image-templates&format=markdown#getting-started-with-image-templates){: external} | You can use IBM Cloud image templates to capture an image of a virtual server to quickly replicate its configuration with minimal changes in the order process. With the End to End (E2E) Encryption feature, you can bring your own encrypted, cloud-init enabled operating system image. | [View docs](https://cloud.ibm.com/docs/image-templates?topic=image-templates-using-end-to-end-e2e-encryption-to-provision-an-encrypted-instance&format=markdown#using-end-to-end-e2e-encryption-to-provision-an-encrypted-instance){: external} | | [KMIP for VMware](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations&format=markdown){: external} | KMIP for VMware works together with VMware native vSphere encryption and vSAN encryption to provide simplified storage encryption management together with the security and flexibility of Key Protect or Hyper Protect Crypto Services customer-managed keys. | [View docs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations&format=markdown){: external} | | [Virtual Servers for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown){: external} | You can use Virtual Servers for VPC to create an instance that consists of your virtual compute resources and resulting capacity within an IBM Cloud VPC. | [View docs](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown){: external} | [Power Virtual Server (Linux)](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-getting-started&format=markdown){: external} | You can protect Linux Unified Key Setup (LUKS) encryption keys from being compromised by using Key Protect. |[View docs](https://developer.ibm.com/tutorials/protect-luks-encryption-keys-with-ibm-cloud-hyper-protect-crypto-services/){: external} | | [Power Virtual Server (AIX)](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-getting-started&format=markdown){: external} | You can protect Linux Unified Key Setup (LUKS) encryption keys from being compromised by using Key Protect. |[View docs](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-integrate-hpcs&format=markdown#AIX-hpcs){: external} | | [Speech to Text](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-gettingStarted&format=markdown){: external} | You can use Speech to Text to create customizable speech recognition for optimal text transcription in your application. | [View docs](https://cloud.ibm.com/docs/watson?topic=watson-iam&format=markdown#gs-credential-cloud){: external} | | [Text to Speech](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-gettingStarted&format=markdown){: external} | You can use Text to Speech's speech-synthesis capabilities to convert written text into natural-sounding speech. | [View docs](https://cloud.ibm.com/docs/watson?topic=watson-iam&format=markdown#gs-credential-cloud){: external} | | [Watson OpenScale](https://dataplatform.cloud.ibm.com/docs/content/wsj/model/getting-started.html?format=markdown){: external} | You can use Watson OpenScale to automate and maintain the AI lifecycle in your business applications. | [View docs](https://cloud.ibm.com/docs/watson?topic=watson-iam&format=markdown#gs-credential-cloud){: external} | | [IBM Watson® Natural Language Understanding](https://cloud.ibm.com/docs/natural-language-understanding?topic=natural-language-understanding-getting-started&format=markdown#getting-started){: external} | You can use IBM Watson® Natural Language Understanding to analyze semantic features of text input, including categories, concepts, emotion, entities, keywords, metadata, relations, semantic roles, and sentiment. | [View docs](https://cloud.ibm.com/docs/watson?topic=watson-iam&format=markdown#gs-credential-cloud){: external} | | [IBM Watson® Personality Insights](https://cloud.ibm.com/docs/natural-language-understanding?topic=natural-language-understanding-about&format=markdown){: external} | You can use IBM Watson® Personality Insights to analyze semantic features of text input, including categories, concepts, emotion, entities, keywords, metadata, relations, semantic roles, and sentiment. | [View docs](https://cloud.ibm.com/docs/watson?topic=watson-iam&format=markdown#gs-credential-cloud){: external} | {: caption="Supported compute services." caption-side="bottom"} ## Container service integrations {: #container-integrations} You can integrate Key Protect with the following **container** services. | Service | Description | Integration docs | | ------- | ----------- | ---------------- | | [IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-getting-started&format=markdown){: external} | You can use the IBM Cloud Kubernetes Service service to deploy highly available apps in Docker containers that run in Kubernetes clusters. | [View docs](https://cloud.ibm.com/docs/containers?topic=containers-encryption&format=markdown){: external} | | [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption&format=markdown) | You can use the Red Hat OpenShift on IBM Cloud service to deploy secure, highly available apps in OpenShift clusters. | [View docs](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption&format=markdown) | {: caption="Supported container services." caption-side="bottom"} ## Ingestion service integrations {: #integration-integrations} You can integrate Key Protect with the following **integration** services. | Service | Description | Integration docs | | ------- | ----------- | ---------------- | | [IBM Cloud Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started&format=markdown){: external} | The IBM Cloud Monitoring service is a container-intelligence management system. You can use it to gain operational visibility into the performance and health of your applications, services, and platforms. | [View docs](https://cloud.ibm.com/docs/monitoring?topic=monitoring-mng-data&format=markdown){: external} | | [IBM Cloud Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-getting-started&format=markdown){: external} | The IBM Cloud Schematics service delivers Terraform-as-a-Service. You can use it to organize your IBM Cloud resources across environments by using workspaces. | [View docs](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-data&format=markdown#pi-encrypt) | | [IBM® Event Streams for IBM Cloud®](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-quick_setup_guide&format=markdown){: external} | The Event Streams service is a high-throughput message bus built with Apache Kafka. You can use it for event ingestion into IBM Cloud and event stream distribution between your services and applications. | [View docs](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryption&format=markdown){: external} | {: caption="Supported integration services." caption-side="bottom"} ## Developer tools service integrations {: #integration-devtools-integrations} You can integrate Key Protect with the following **developer tools** services. | Service | Description | Integration docs | | ------- | ----------- | ---------------- | | [IBM Cloud Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-getting-started&format=markdown){: external} | The Continuous Delivery service provides a suite of tools that support DevOps best practices. You can use the service to manage toolchains, operate delivery pipelines, gain insights into code quality and vulnerabilities, integrate third party tools, and more. | [Creating a Continuous Delivery service instance](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-create_cd_service&format=markdown){: external} [Protecting your personal data when you use the Professional plan](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_security&format=markdown#cd_professional_plan){: external} | {: caption="Supported developer tools services." caption-side="bottom"} ## Understanding your integration {: #understand-integration} When you integrate a supported service with Key Protect, you enable [envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption&format=markdown) for that service. This integration allows you to use a root key that you store in Key Protect to wrap the data encryption keys that encrypt your data at rest. For example, you can create a root key, manage the key in Key Protect, and use the root key to protect the data that is stored across different cloud services. ![The diagram shows a contextual view of your Key Protect integration.](../images/kp-integrations.svg){: caption="Contextual view of Key Protect integration." caption-side="bottom"} ### Key Protect API methods {: #envelope-encryption-api-methods} Behind the scenes, the Key Protect API drives the envelope encryption process. The following table lists the API methods that add or remove envelope encryption on a resource. | Method | Description | | ------ | ----------- | | `POST /keys/{root_key_ID}/actions/wrap` | [Wrap (encrypt) a data encryption key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keys&format=markdown) | | `POST /keys/{root_key_ID}/actions/unwrap` | [Unwrap (decrypt) a data encryption key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-unwrap-keys&format=markdown) | {: caption="Describes the Key Protect API methods." caption-side="bottom"} To find out more about programmatically managing your keys in Key Protect, check out the [Key Protect API reference doc](https://cloud.ibm.com/apidocs/key-protect){: external}. {: tip} ## Integrating a supported service {: #grant-access} To add an integration, create an authorization between services by using the IBM Cloud® Identity and Access Management dashboard. Authorizations enable service to service access policies, so you can associate a resource in your cloud data service with a [root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption&format=markdown#key-types) that you manage in Key Protect. Be sure to provision both services in the same region before you create an authorization. To learn more about service authorizations, see [Granting access between services](https://cloud.ibm.com/docs/iam?topic=iam-serviceauth&format=markdown){: external}. {: note} When you're ready to integrate a service, use the following steps to create an authorization: 1. From the menu bar, click **Manage** > **Access (IAM)**, and select **Authorizations**. 2. Click **Create**. 3. Select a source and target service for the authorization. For **Source service**, select the cloud data service that you want to integrate with Key Protect For **Target service**, select **IBM Key Protect**. 4. Enable the **Reader** role. With _Reader_ permissions, your source service can browse the root keys that are provisioned in the specified instance of Key Protect. 5. Click **Authorize**. ## What's next {: #integration-next-steps} Add advanced encryption to your cloud resources by creating a root key in Key Protect. Add a new resource to a supported cloud data service, and then select the root key that you want to use for advanced encryption. - To find out more about creating root keys with the Key Protect service, see [Creating root keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys&format=markdown). - To find out more about bringing your own root keys to the Key Protect service, see [Importing root keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keys&format=markdown).