---
layout: docs
page_title: AEAD KMS configuration
description: >-
  Learn about using the Authenticated Encryption with Associated Data (AEAD) KMS for key management. AEAD is typically used for development workflows or testing.
---

⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
> [!IMPORTANT]  
> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com.
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️

# `aead` KMS

~> **Note:** This is mostly used for `dev` workflows or testing. The key will be exposed
to anyone that can view the configuration file. If using this KMS, consider
using `boundary config encrypt` to encrypt all but the `config` KMS and using an
external KMS for `config` purposes.

```hcl
kms "aead" {
	purpose = "worker-auth"
	aead_type = "aes-gcm"
	key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
	key_id = "global_worker-auth"
}
```

- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`,
   `root`, `previous-root`, `recovery`, `bsr`, or `config`.

- `aead_type` - The type of encryption this KMS uses. Currently only `aes-gcm` is implemented.

- `key` - The base64-encoded 256-bit encryption key.

- `key_id` - The unique name of this key.
It is used to identify the key when you perform a root key migration.
You can use the `key_id` field with all KMS stanzas.