ShareFile
View PDF

Customer managed encryption keys for Cloud storage

January 27, 2026
Contributed by: 
P

As a customer using ShareFile cloud (ShareFile managed storage zones) to store files, you have the ability to manage your own encryption keys and have much better control over security. You can use Amazon Web Services to generate a master key to encrypt ShareFile data uploaded to the cloud using a dual encryption key paradigm.

Note:

This feature is not currently available for HIPAA-accounts.

Overview

Customers have complete control over their encryption keys and can revoke ShareFile’s access to their master keys whenever they want. When access is revoked, ShareFile can no longer decrypt the encrypted files.

Setup instructions to enable this feature on your account below assume that you have an Amazon Web Services Account with access to IAM (Identity and Access Management)

Creating the KMS Key and Granting ShareFile Access

Note:

To improve performance, ShareFile recommends creating the KMS key in the same region as your ShareFile zone. For example: if using the US-East storage zone, create the KMS key in the US-East region.

Configure CloudTrail Logging

Note:

For improved performance, it is recommended to create the KMS key in a similar region as your ShareFile zone. For example: if using the US-EastShareFile-managed StorageZone, create the KMS key in the US-East region.

  1. Go to the KMS Console website or search for AWS Key Management Service and click Create a key.
  2. From the Create Key wizard, select these values, then click next:
    • Key type - Symmetric
    • Key material origin - KMS
    • Regionality - Single-Region key
  3. Add an alias for the key, and optionally a description and label.
  4. Select Next.
  5. Under define key permissions, you can leave the default values.

  6. Under Define key usage permissions, select Add Another AWS account. 1. Enter the ShareFile external account ID. Select Next to continue.

    Note:

    Please contact Support to obtain the external account ID.

  7. Select Finish to review and complete the process.

  8. After that, select the Key you just created to check its properties. Copy the ARN and send it to ShareFile Support.

Validating Key Operations

Test Disabling the KMS Key

  1. Perform some test uploads and downloads to your Zone

  2. From the AWS Console, select your key and choose Disable.

    Wait a few minutes and then try to upload or download to your Zone once more. You should see the operations fail.

  3. Re-enable the KMS key and verify that you can upload and download successfully.

Test Revoking the ShareFile External Account

  1. Edit the KMS Key and browse to External Accounts

  2. Select the “Remove” option to revoke ShareFile access to this key (save the value before deletion)

    Wait a few minutes and then attempt to upload or download. You should see the operations fail.

  3. Re-add the external account.

    Wait a few minutes and then reattempt uploads or downloads. The operations should be successful.

Verify Activity via CloudTrail Logs

  • After performing some uploads and downloads, check CloudTrails activity. (may take ~10 minutes to populate)
  • Verify you can see Activity such as username, filename, and operation (Upload or Download).

Note:

File Names that contain special characters or Unicode characters will appear as URL-encoded in the CloudTrail logs. To view the filename, you can use a URL decoder.

Customer managed encryption keys for Cloud storage
January 27, 2026
Contributed by: 
P
January 27, 2026
Contributed by: 
P

In this article

Site feedback | Privacy and legal terms | Cookie preferences

About Us | Awards | Press Releases | Media Coverage | Careers | Offices | Security Center | License Agreement | Do Not Sell or Share My Personal Information

Copyright © Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.

Progress and certain product names used herein are trademarks or registered trademarks of Progress Software Corporation and/or one of its subsidiaries or affiliates in the U.S. and/or other countries. See Trademarks for appropriate markings. All rights in any other trademarks contained herein are reserved by their respective owners and their inclusion does not imply an endorsement, affiliation, or sponsorship as between Progress and the respective owners.