diff --git a/lib/config/configuration.go b/lib/config/configuration.go
index 55b34c2daf421..bde7978107c7d 100644
--- a/lib/config/configuration.go
+++ b/lib/config/configuration.go
@@ -1167,13 +1167,15 @@ func applyAWSKMSConfig(kmsConfig *AWSKMS, cfg *servicecfg.Config) error {
 	if kmsConfig.Account == "" {
 		return trace.BadParameter("must set account in ca_key_params.aws_kms")
 	}
-	cfg.Auth.KeyStore.AWSKMS.AWSAccount = kmsConfig.Account
 	if kmsConfig.Region == "" {
 		return trace.BadParameter("must set region in ca_key_params.aws_kms")
 	}
-	cfg.Auth.KeyStore.AWSKMS.AWSRegion = kmsConfig.Region
-	cfg.Auth.KeyStore.AWSKMS.MultiRegion = kmsConfig.MultiRegion
-	cfg.Auth.KeyStore.AWSKMS.Tags = kmsConfig.Tags
+	cfg.Auth.KeyStore.AWSKMS = &servicecfg.AWSKMSConfig{
+		AWSAccount:  kmsConfig.Account,
+		AWSRegion:   kmsConfig.Region,
+		MultiRegion: kmsConfig.MultiRegion,
+		Tags:        kmsConfig.Tags,
+	}
 	return nil
 }