--- title: Take control of your encryption keys with Bring Your Own... description: Dynatrace has made Bring Your Own Key (BYOK) generally available for SaaS customers running on AWS. BYOK lets organizations create and manage their own... canonical: https://daily.dev/posts/take-control-of-your-encryption-keys-with-bring-your-own-key-on-aws-vxrsnt30q twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Take control of your encryption keys with Bring Your Own Key on AWS | daily.dev og:description: Dynatrace has made Bring Your Own Key (BYOK) generally available for SaaS customers running on AWS. BYOK lets organizations create and manage their own... og:url: https://daily.dev/posts/take-control-of-your-encryption-keys-with-bring-your-own-key-on-aws-vxrsnt30q og:image: https://api.daily.dev/og/posts/vXRSNt30q.png og:image:alt: Take control of your encryption keys with Bring Your Own Key on AWS og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Take control of your encryption keys with Bring Your Own Key on AWS **[Dynatrace](https://daily.dev/sources/dynatrace)** · 8 min read · 0 upvotes · 0 comments ## Summary Dynatrace has made Bring Your Own Key (BYOK) generally available for SaaS customers running on AWS. BYOK lets organizations create and manage their own encryption keys in AWS Key Management Service (KMS), replacing Dynatrace-managed keys for data at rest — including Grail storage, Notebooks, Dashboards, and Workflows. Key capabilities include key activation, rotation (with AWS automatic rotation support), and revocation by disabling the key in AWS KMS. If a key becomes inaccessible, Dynatrace automatically detects the issue and notifies security contacts. A key limitation: existing data is not re-encrypted when switching keys, so old keys must be retained. The feature targets regulated industries like banking, healthcare, and government that require demonstrable control over encryption and data sovereignty. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Bring Your Own Key (BYOK) for Dynatrace on AWS? BYOK lets Dynatrace SaaS customers on AWS create and manage their own encryption key in AWS Key Management Service (KMS) instead of relying on a Dynatrace-managed key. Dynatrace uses that customer-owned key to encrypt and decrypt platform data at rest, including Grail data, Notebooks, Dashboards, and Workflows. It is generally available for all Dynatrace SaaS customers on AWS. _Teams evaluating SaaS encryption controls can track releases like this BYOK feature on daily.dev._ ### What happens to my data if I revoke or disable my AWS KMS key used for Dynatrace BYOK? Disabling the customer-managed key in AWS KMS immediately prevents Dynatrace from reading or writing any data encrypted with that key, giving an independent revocation mechanism that requires no action from Dynatrace. Dynatrace also automatically detects the inaccessible key, notifies designated security and emergency contacts by email, and shows a status indicator in Account Management. _Anyone weighing key-revocation controls for compliance can follow security architecture updates like this on daily.dev._ ### Do I need to keep old encryption keys after switching to a new one with Dynatrace BYOK? Yes, because switching to a new customer-managed key does not automatically re-encrypt existing data. New data gets encrypted with the newly activated key, while previously stored data remains encrypted under whichever key was active when it was written, so all prior keys must stay accessible as long as that data exists. _Engineers planning key-rotation strategy can keep an eye on encryption practices like these via daily.dev._ ## Similar posts on daily.dev - [BYOK for existing Elastic Cloud deployments is now GA](https://daily.dev/posts/byok-for-existing-elastic-cloud-deployments-is-now-ga-suahfmztk) · elastic · 0 upvotes · 0 comments - [What is Bring Your Own Encryption \(BYOE\)?](https://daily.dev/posts/what-is-bring-your-own-encryption-byoe--yh4fqrkpx) · Security Boulevard · 0 upvotes · 0 comments - [Bring Your Own Key \(BYOK\): AWS IAM Identity Center Adopts CMKs to Meet Enterprise Compliance Needs](https://daily.dev/posts/bring-your-own-key-byok-aws-iam-identity-center-adopts-cmks-to-meet-enterprise-compliance-needs-xbvookuzs) · InfoQ · 0 upvotes · 0 comments - [How to set up BYOK in Kilo Gateway for DeepSeek, AWS Bedrock, MiniMax, Z.ai, and 15\+ more providers](https://daily.dev/posts/how-to-set-up-byok-in-kilo-gateway-for-deepseek-aws-bedrock-minimax-z-ai-and-15-more-providers-jujf8mt5d) · Kilo Blog · 0 upvotes · 0 comments - [Bring Your Own Key \(BYOK\) Is Now Live in JetBrains IDEs](https://daily.dev/posts/bring-your-own-key-byok-is-now-live-in-jetbrains-ides-b8lg34y7n) · JetBrains · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#compliance](https://daily.dev/tags/compliance), [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/take-control-of-your-encryption-keys-with-bring-your-own-key-on-aws-vxrsnt30q) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Take control of your encryption keys with Bring Your Own Key on AWS","url":"https://daily.dev/posts/take-control-of-your-encryption-keys-with-bring-your-own-key-on-aws-vxrsnt30q","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/take-control-of-your-encryption-keys-with-bring-your-own-key-on-aws-vxrsnt30q"},"datePublished":"2026-07-29T20:14:40.734Z","dateModified":"2026-09-13T18:53:39.424Z","description":"Dynatrace has made Bring Your Own Key (BYOK) generally available for SaaS customers running on AWS. BYOK lets organizations create and manage their own...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f0a1e235fd7672e6760f8dd045fa0d36?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f0a1e235fd7672e6760f8dd045fa0d36?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dynatrace","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dynatrace","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3ca5a9897e9748f4a39fa9736389609e","url":"https://daily.dev/sources/dynatrace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/take-control-of-your-encryption-keys-with-bring-your-own-key-on-aws-vxrsnt30q","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devops,compliance,encryption","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dynatrace","item":"https://daily.dev/sources/dynatrace"},{"@type":"ListItem","position":3,"name":"Take control of your encryption keys with Bring Your Own Key on AWS"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/take-control-of-your-encryption-keys-with-bring-your-own-key-on-aws-vxrsnt30q#faq","mainEntity":[{"@type":"Question","name":"What is Bring Your Own Key (BYOK) for Dynatrace on AWS?","acceptedAnswer":{"@type":"Answer","text":"BYOK lets Dynatrace SaaS customers on AWS create and manage their own encryption key in AWS Key Management Service (KMS) instead of relying on a Dynatrace-managed key. Dynatrace uses that customer-owned key to encrypt and decrypt platform data at rest, including Grail data, Notebooks, Dashboards, and Workflows. It is generally available for all Dynatrace SaaS customers on AWS. Teams evaluating SaaS encryption controls can track releases like this BYOK feature on daily.dev."}},{"@type":"Question","name":"What happens to my data if I revoke or disable my AWS KMS key used for Dynatrace BYOK?","acceptedAnswer":{"@type":"Answer","text":"Disabling the customer-managed key in AWS KMS immediately prevents Dynatrace from reading or writing any data encrypted with that key, giving an independent revocation mechanism that requires no action from Dynatrace. Dynatrace also automatically detects the inaccessible key, notifies designated security and emergency contacts by email, and shows a status indicator in Account Management. Anyone weighing key-revocation controls for compliance can follow security architecture updates like this on daily.dev."}},{"@type":"Question","name":"Do I need to keep old encryption keys after switching to a new one with Dynatrace BYOK?","acceptedAnswer":{"@type":"Answer","text":"Yes, because switching to a new customer-managed key does not automatically re-encrypt existing data. New data gets encrypted with the newly activated key, while previously stored data remains encrypted under whichever key was active when it was written, so all prior keys must stay accessible as long as that data exists. Engineers planning key-rotation strategy can keep an eye on encryption practices like these via daily.dev."}}]} ```