> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/3.0/harness-platform-resources/secrets/secrets-management/add-an-aws-kms-secrets-manager.md).

# Add an AWS KMS secret manager

To store and use encrypted secrets (such as access keys) and files, you can add an AWS KMS Secret Manager.

This topic describes how to add an AWS KMS Secret Manager in Harness.

#### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* [Harness' key concepts](/harness-ai/new-to-harness-platform/overview.md)
* [Harness Secret Manager Overview](/harness-ai/use-harness-platform/secrets/secrets-management/harness-secret-manager-overview.md)
* [Store authentication credentials](/harness-ai/use-harness-platform/secrets/secrets-management/store-authentication-credentials.md)

#### 1: Add a Secret Manager <a href="#id-1-add-a-secret-manager" id="id-1-add-a-secret-manager"></a>

Navigate to **Settings** → **Account-level resources** → **Connectors** and click **New Connector**. Then, go to **Secret Managers** and select **AWS KMS**.

#### 2: Overview <a href="#id-2-overview" id="id-2-overview"></a>

* Enter a **Name** for your secret manager.

  ```
    > You can either update the **ID** or leave it the same as your secret manager's name. For more information, see [Entity Identifier Reference](https://app.gitbook.com/s/3F2TpHXhur2QtQnORSM9/use-harness-platform/references/entity-identifier-reference).
  ```
* (Optional) Enter a **Description** and **Tags** for your secret manager.
* Select **Continue**.

#### 3: Details <a href="#id-3-details" id="id-3-details"></a>

Select the Credential Type. There are four ways to authenticate with AWS, as shown below:

* [**AWS Access Key.**](#option-1-aws-access-key)
* [**Assume IAM role on Delegate.**](#option-2-assume-iam-role-on-delegate)
* [**Assume Role using STS on Delegate.**](#option-3-assume-role-using-sts-on-delegate)
* [**Use OIDC**](#option-4-oidc---openid-connect)

#### Option 1: AWS Access Key <a href="#option-1-aws-access-key" id="option-1-aws-access-key"></a>

Use your AWS IAM user login credentials.

{% hint style="info" %}
You can get the **AWS Access Key ID**, **AWS Secret Key**, and **Amazon Resource Name (ARN)** either from the **Key Policy** JSON or from the AWS **IAM** console under **Encryption keys**.
{% endhint %}

For more information, refer to the AWS guide on [viewing the Key ID and ARN](https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn)

* **AWS Access Key ID**
  * Select **Create or Select a Secret**.
  * In the secret settings dialog, you can create or select a [Secret](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md) and enter your AWS Access Key as its value.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><ul><li>The AWS Access Key is the AWS Access Key ID for the IAM user you want to use to connect to secret manager.</li></ul></div>
* **AWS Secret Access Key**
  * Select **Create or Select a Secret**. You can create a new [Secret](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md) with your Access Key ID's secret key as the **Secret Value**, or use an existing secret.
* **AWS ARN**: You can provide the AWS ARN as plain text or as an encrypted secret.

  ![arn](/files/FRxdDNT2Vqcef6f0HNtf)

#### Option 2: Assume IAM Role on Delegate <a href="#option-2-assume-iam-role-on-delegate" id="option-2-assume-iam-role-on-delegate"></a>

If you select **Assume the IAM Role on Delegate** Harness will authenticate using the IAM role assigned to the AWS host running the Delegate, you select using a Delegate Selector.

* **AWS ARN**: Enter the AWS ARN directly as plain text or as an encrypted secret.

  ![](/files/rbyLlu3JOtD5OpMVDTcs)
* Select the **Region**, then click **Continue**.

#### Option 3: Assume Role using STS on Delegate <a href="#option-3-assume-role-using-sts-on-delegate" id="option-3-assume-role-using-sts-on-delegate"></a>

This option uses the [AWS Security Token Service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) (STS) feature. Typically, you use `AssumeRole` within your account or for AWS cross-account access.

* **AWS ARN**: Provide the ARN either in plain text or as an encrypted secret.

  ![](/files/KYEfbhPeZtfMgDEB9rg2)
* **Region**: select your AWS region.
* **Role ARN**: Enter the Amazon Resource Name (ARN) of the role that you want to assume. This is an IAM role in the target deployment AWS account.
* **External ID**: If the administrator of the account to which the role belongs provided you with an external ID, then enter that value. For more information, see [How to Use an External ID When Granting Access to Your AWS Resources to a Third Party](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html) in the AWS documentation.
* **Assume Role Duration (seconds)**: This field sets the AssumeRole session duration. For more details, see [Session Duration](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) in the AWS AssumeRole documentation.

.

#### Option 4: OIDC - OpenID Connect. <a href="#option-4-oidc-openid-connect" id="option-4-oidc-openid-connect"></a>

This option uses OpenID Connect (OIDC) to authenticate and authorize users. This option is commonly used for secure identity federation across different applications or cloud platforms, enabling seamless authentication and access management.

* **AWS ARN**: Choose to input your ARN either as plain text or as an encrypted secret.

  ![odic-aws-kms](/files/jcKHoQjHxyFLuptMqSwS)
* **Region and IAM Role**: Once your configuration is complete, set the IAM role and region below to proceed with the setup, as shown in the image above.
* **Delegate Selectors for Access Control** (optional): You can use delegate selectors in OIDC tokens to restrict access to secrets based on which delegates execute tasks. This is useful for enforcing environment-level boundaries. For more information, go to [Delegate selectors as session tags](/harness-ai/use-harness-platform/connectors/cloud-providers/ref-cloud-providers/aws-connector-settings-reference.md#delegate-selectors-as-session-tags).

<details>

<summary>An additional step before proceeding.</summary>

#### Connectivity mode

This additional step allows you to select the connectivity mode.

Once you have selected OIDC, you will be able to select **connectivity mode**, based on the requirement you can select the provider that can be either connect through a **delegate** or through **Harness platform**.

![connectivity-mode](/files/hpGQtlf6Mbu8BuSOrAEU)

</details>

#### 3: Setup Delegates <a href="#id-3-setup-delegates" id="id-3-setup-delegates"></a>

In **Delegates** **Setup**, enter [**Selectors**](/harness-ai/use-harness-platform/delegates/delegate/manage-delegates/select-delegates-with-selectors.md#option-select-a-delegate-for-a-connector-using-tags) for specific **Delegates** that you want to allow to connect to this Connector. Select **Save and Continue**.

#### 4: Test Connection <a href="#id-4-test-connection" id="id-4-test-connection"></a>

In **Connection** **Test**, select **Finish** after your connection is successful.