> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Manage Vaults

This article explains how to add a vault for your Eon snapshots.

Vaults are required for most backup policies.
After you add the vault, you can set it as a destination for snapshots in your [backup policies].

For AWS and GCP vaults, you can choose whether to encrypt your snapshots with an Eon-managed or self-managed vault key:

* [Create a vault with an Eon-managed key](#create-a-vault-with-an-eon-managed-key) (recommended)
* [Create a vault with a self-managed key](#create-a-vault-with-a-self-managed-key)

For Azure vaults, only the Eon-managed key is available.

## Create a vault with an Eon-managed key

The Eon-managed key is recommended and provides several advantages, including air-gapped security, automatic rotation, and simplified management.
You can create a vault that uses an Eon-managed vault key for AWS, Azure, or GCP vaults.

#### Before you start

After creation, only the vault name and display color can be changed.
All other settings are permanent.
Make sure you know, and double-check, the settings you need before creating the vault.

#### Set the vault configuration

1. In the

   Vaults

   page, click **Create Vault**.
   The **Create vault** panel opens.

2. Set the vault's display name, cloud provider, region, and display color.

#### Review and save

After the vault is created, only the vault name and display color can be changed, and the vault can't be deleted.
Therefore, it's critical to take a moment to double-check your vault configuration before continuing.

If the configuration is correct, click **Create Vault**.

The vault is created.
When configuring [backup policies], you can now select the new vault as the destination for snapshots.

## Create a vault with a self-managed key

If your requirements mandate more control over encryption keys, you can create an AWS or GCP vault that encrypts your snapshots with a self-managed KMS key.
This requires additional setup and ongoing management.

> **Error**
>
> By using self-managed vault keys, you assume responsibility for securing against unauthorized access and accidental deletion.
> If a key is deleted, any snapshots encrypted with it will be unretrievable.

#### Before you start

* After creation, only the vault name and display color can be changed.
  All other settings are permanent.
  Make sure you know, and double-check, the settings you need before creating the vault.

* Review [About Self-Managed Vault Keys], paying special attention to [Best practices].

* Make sure you have a KMS key ready:

  * **AWS**: A [customer-managed KMS key] in the same region as the vault.
    If using a multi-region key, make sure the key has a replica in the vault region.

  * **GCP**: A [Cloud KMS key] in the same region as the vault.

#### Set the vault configuration

1. In the

   Vaults

   page, click **Create Vault**.
   The **Create vault** panel opens.

2. Set the vault's display name, cloud provider, region, and display color.
   Pay special attention to the cloud provider and region:

   * Cloud provider must be either **AWS** or **GCP**.

   * The key (or replica in AWS) must be in the same region as the vault.

3. Expand **Advanced options** and turn on **Use my own KMS key** (AWS) or **Use my own Cloud KMS key** (GCP).

4. Click **Set Key**.

#### Set the key and grant access

In the key selection dialog, provide the key identifier and grant Eon access to use the key.

#### AWS vault

1. In the **KMS key ARN** field, paste the key's ARN.

2. Click **Edit Key Policy in AWS** to open the key in the AWS console.

3. Copy the policy statement from the code panel and add it to the key policy in AWS.
   This grants Eon permission to use your key for encrypting backups.

   The policy also contains a statement that grants your currently connected restore accounts permission to access the key when restoring from the vault.

4. Click **Done** to return to the **Create vault** panel.

#### GCP vault

1. In the **CMEK key resource name** field, paste the key's resource ID.
   The resource ID has the format `projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`.

2. Copy the `gcloud` commands from the script panel.
   These commands grant Eon permission to use your key for encrypting backups.

   The script also contains commands that grant your currently connected restore accounts permission to access the key when restoring from the vault.

3. Run the commands in your terminal where you're logged in to `gcloud` with permissions to modify the key.

4. Click **Done** to return to the **Create vault** panel.

> **Info**
>
> You can always [grant access to additional restore accounts] later.
> That's not required at this time, but will be required when you want to restore or query snapshots from vaults that use this key.

#### Review and save

After the vault is created, only the vault name and display color can be changed, and the vault can't be deleted.
Therefore, it's critical to take a moment to double-check your vault configuration before continuing.

Click **Create Vault**.
Eon tests the key for the required permissions.

If the test is successful, the vault is created, and your self-managed key is used when encrypting snapshots to the vault.
When configuring [backup policies], you can now select the new vault as the destination for snapshots.

If the test fails, you'll see an error message with the reason it failed.
Make sure the key is in the vault's region and that you've granted Eon access to the key.
For troubleshooting help, contact [Eon Support].

[backup policies]: /data-protection/backup-and-protection/backup-configuration/backup-policies/about-backup-policies

[customer-managed KMS key]: https://console.aws.amazon.com/kms/home#/kms/keys

[Cloud KMS key]: https://console.cloud.google.com/security/kms/keyrings

[Eon support]: mailto:help@eon.io

[grant access to additional restore accounts]: /data-protection/backup-and-protection/backup-configuration/vaults/about-self-managed-vault-keys#enable-restoring-with-a-self-managed-key

## See also

* [About Vaults]
* [About Self-Managed Vault Keys]

[About Vaults]: /data-protection/backup-and-protection/backup-configuration/vaults/about-vaults

[About Self-Managed Vault Keys]: /data-protection/backup-and-protection/backup-configuration/vaults/about-self-managed-vault-keys

[Best practices]: /data-protection/backup-and-protection/backup-configuration/vaults/about-self-managed-vault-keys#best-practices