Use an AWS KMS symmetric key for conversations

1. Create a customer managed key in your AWS account.
   1. Set the key type to Symmetric.
   2. Set the key usage to Encrypt and decrypt.
2. Edit the key policy to grant access to Genesys Cloud, so Genesys Cloud can access your KMS keys. Use 765628985471 (Core/Satellite regions) for the account ID. If needed, please contact your Genesys representative for the FedRAMP region [US-East-2] account ID.
3. Edit the key policy to include a statement to only allow requests that initiate from your Genesys Cloud organizations.

The following is an example of the key policy statement:

{
     “Sid”: “Allow use of the key”,
     “Effect”: “Allow”,
     “Principal”: {
         “AWS”: [
              “arn:aws:iam::765628985471:root”
         ]
     },
     “Action”: [
         “kms:Encrypt”,
         “kms:Decrypt”,
         “kms:GenerateDataKey*”,
         “kms:DescribeKey”
     ],
     “Resource”: “*”,
     “Condition”: {
          “StringEquals”: {
                 “kms:EncryptionContext:genesys-cloud-organization-id”: [“orgId1”, “orgId2”, …]
        }
     }
}

1. Click Admin > Quality > Encryption Keys.
2. Click Menu > Conversation Intelligence > Recording Policies > Encryption Keys.
3. Select the Conversations tab and click Edit. 
4. From the Key Configuration Type list, select AWS KMS Symmetric.
5. Enter the alias ARN associated with your KMS key in the ARN of the AWS KMS key alias for generating Customer Secured Data key text box.
   The key alias ARN can be found in the AWS KMS console. It should look like “arn:aws:kms:{region}:{accountId}:alias/{your-alias}”.
6. Click the Test button to validate your configuration without saving it. The test generates a data key pair from your specified KMS key, encrypts the test data, decrypts it, and then asserts that test data came out the same as it started. This test helps to ensure that the configuration is safe to use.
7. Click Save to save your configuration. 

Click the image to enlarge.