As the setup steps in [step 3](https://developers.google.com/tink/tink-setup) are KMS-dependent, now is the time
to select which available KMS you want to use:

- [Google Cloud KMS](https://cloud.google.com/kms/docs/)
- [Amazon KMS](http://docs.aws.amazon.com/kms/)
- [HashiCorp Vault](https://developer.hashicorp.com/vault/docs/what-is-vault) (currently only available in Go language)

> [!NOTE]
> **Note:** To protect your Tink-generated keys, you'll create a key encryption key (KEK) in [step 5](https://developers.google.com/tink/key-management-overview#create_kek), which requires the use of the Key Management System (KMS) selected here.