![Set up BYOK with Yandex KMS](https://pachca.com/help/yandexkms-art.jpg)

# Set up BYOK with Yandex KMS

> A step-by-step guide to setting up BYOK encryption with Yandex Key Management Service in the Pachca team chat app to protect your data

Источник: https://pachca.com/en/help-center/administration/instrukciya-po-nastroyke-byok-s-yandex-kms

1.  Open the [Yandex KMS](https://yandex.cloud/ru/services/kms) console

![Yandex KMS console](https://pachca.com/kms-1.png)

2.  Go to **Identity and Access Management** and click **Create service account**

![Creating a service account in IAM](https://pachca.com/kms-2.png)

3.  Give the service account a name and assign it the **kms.keys.encrypterDecrypter** role

![Assigning the kms.keys.encrypterDecrypter role](https://pachca.com/kms-3.png)

4.  Open the new service account for editing and click **Create new key**. Select **Create authorized key** with the RSA-2048 encryption algorithm

![Creating an RSA-2048 authorized key](https://pachca.com/kms-4.png)

![Key encryption algorithm settings](https://pachca.com/kms-5.png)

5.  Download the key file

![Downloading the authorized key file](https://pachca.com/kms-6.png)

6.  Paste the contents of the downloaded file into Pachca. This is your **JSON key for encryption system authorization**

```json
{
  "id": "ajeobp8qi8slm13qe4fv",
  "service_account_id": "...",
  "created_at": "...",
  "key_algorithm": "RSA_2048",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIB...",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhki..."
}
```

7.  In Key Management System, go to **Symmetric keys** and click **Create key**

![Creating a symmetric key in KMS](https://pachca.com/kms-7.png)

8.  Select the AES-128 encryption algorithm and leave the rotation period empty

![Selecting the AES-128 encryption algorithm](https://pachca.com/kms-8.png)

9.  In the key's access permissions, specify the service account with the **kms.keys.encrypterDecrypter** role

![Setting access permissions for the encryption key](https://pachca.com/kms-9.png)

10.  Copy the ID of the key you created and enter it in Pachca in the **KMS Key ID** field

11.  Click **Enable encryption**

Advanced data encryption is now on for your Pachca workspace.

Updated: September 1, 2025