diff --git a/manifests/guestagent.pp b/manifests/guestagent.pp
index 7d7644b4..3f6d9433 100644
--- a/manifests/guestagent.pp
+++ b/manifests/guestagent.pp
@@ -64,6 +64,10 @@
 #   guests need to talk to the rabbit cluster via
 #   a different ssl connection option.
 #
+# [*backup_aes_cbc_key*]
+#   (optional) Default OpenSSL aes_cbc key
+#   Defaults to $::os_service_default.
+#
 #  DEPRECATED PARAMETERS
 #
 # [*root_grant*]
@@ -120,6 +124,7 @@ class trove::guestagent(
   $root_grant                = $::os_service_default,
   $root_grant_option         = $::os_service_default,
   $default_password_length   = $::os_service_default,
+  $backup_aes_cbc_key        = $::os_service_default,
   #Deprecated
   $control_exchange          = undef,
   $rabbit_hosts              = $::trove::rabbit_hosts,
@@ -146,6 +151,7 @@ trove::guestagent::default_transport_url instead.")
     'DEFAULT/root_grant':              value => $root_grant;
     'DEFAULT/root_grant_option':       value => $root_grant_option;
     'DEFAULT/default_password_length': value => $default_password_length;
+    'DEFAULT/backup_aes_cbc_key':      value => $backup_aes_cbc_key;
   }
 
   oslo::messaging::default { 'trove_guestagent_config':
diff --git a/releasenotes/notes/configure-backup_aes_cbc_key-aaf934036d76ee57.yaml b/releasenotes/notes/configure-backup_aes_cbc_key-aaf934036d76ee57.yaml
new file mode 100644
index 00000000..4f11093b
--- /dev/null
+++ b/releasenotes/notes/configure-backup_aes_cbc_key-aaf934036d76ee57.yaml
@@ -0,0 +1,3 @@
+---
+features:
+  - Add the ability to configure aes_cbc key for backup in trove-guestagent.conf
diff --git a/spec/classes/trove_guestagent_spec.rb b/spec/classes/trove_guestagent_spec.rb
index 07a6b053..32c66e85 100644
--- a/spec/classes/trove_guestagent_spec.rb
+++ b/spec/classes/trove_guestagent_spec.rb
@@ -52,6 +52,7 @@ describe 'trove::guestagent' do
         is_expected.to contain_trove_guestagent_config('DEFAULT/root_grant').with_value('<SERVICE DEFAULT>')
         is_expected.to contain_trove_guestagent_config('DEFAULT/root_grant_option').with_value('<SERVICE DEFAULT>')
         is_expected.to contain_trove_guestagent_config('DEFAULT/default_password_length').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_trove_guestagent_config('DEFAULT/backup_aes_cbc_key').with_value('<SERVICE DEFAULT>')
       end
 
       context 'when using a single RabbitMQ server' do