// file included in the following:
//
// record-encryption-guide/index.adoc

[id='proc-configuring-record-encryption-filter-{context}']
= Configuring the Record Encryption filter

[role="_abstract"]
This section describes at a high level how to configure the Record Encryption filter using a previously prepared KMS.
Subsections provide in-depth details.

.Prerequisites

* An instance of Kroxylicious. +
For information on deploying Kroxylicious, see the {ProxyGuide} or {OperatorGuide}.
* A KMS has been prepared for use by the filter, with KEKs to encrypt records set up for topics.

.Procedure

. Configure the plugin for your supported KMS, as required.
+
* <<con-vault-plugin-configuration-{context},HashiCorp Vault plugin configuration>>
* <<con-aws-kms-plugin-configuration-{context},AWS KMS plugin configuration>>
ifdef::include-fortanix-dsm-kms[]
* <<con-fortanix-dsm-plugin-configuration-{context},Fortanix DSM plugin configuration>>
endif::[]

. Create a filter configuration that references the configured KMS plugins.
+
See <<con-record-encryption-filter-config-{context}>>

. Apply the filter configuration:

ifdef::include-platform-bare-metal[]
* In a standalone proxy deployment. See <<con-example-proxy-config-{context}>>
endif::[]
ifdef::include-platform-kubernetes[]
* In a Kubernetes deployment using a `KafkaProcotolFilter` resource. See <<con-example-kafkaprotocolfilter-resource-{context}>>
endif::[]

include::../modules/record-encryption/hashicorp-vault/con-vault-plugin-configuration.adoc[leveloffset=+1]

include::../modules/record-encryption/aws-kms/con-aws-kms-plugin-configuration.adoc[leveloffset=+1]

ifdef::include-fortanix-dsm-kms[]
include::../modules/record-encryption/fortanix-dsm/con-fortanix-dsm-plugin-configuration.adoc[leveloffset=+1]
endif::[]

include::../modules/record-encryption/con-record-encryption-filter-config.adoc[leveloffset=+1]

ifdef::include-platform-bare-metal[]
include::../modules/record-encryption/con-example-proxy-config.adoc[leveloffset=+1]
endif::[]

ifdef::include-platform-kubernetes[]
include::../modules/record-encryption/con-example-kafkaprotocolfilter-resource.adoc[leveloffset=+1]
endif::[]