diff --git a/app/models/auth_private_key.rb b/app/models/auth_private_key.rb
index 88fec377112f..2d1e7a518308 100644
--- a/app/models/auth_private_key.rb
+++ b/app/models/auth_private_key.rb
@@ -1,2 +1,3 @@
 class AuthPrivateKey < Authentication
+  acts_as_miq_taggable
 end
diff --git a/app/models/manageiq/providers/cloud_manager/provision_workflow.rb b/app/models/manageiq/providers/cloud_manager/provision_workflow.rb
index 0821296f42a3..9be1b1a13cb8 100644
--- a/app/models/manageiq/providers/cloud_manager/provision_workflow.rb
+++ b/app/models/manageiq/providers/cloud_manager/provision_workflow.rb
@@ -35,7 +35,7 @@ def allowed_cloud_subnets(_options = {})
 
   def allowed_guest_access_key_pairs(_options = {})
     source = load_ar_obj(get_source_vm)
-    targets = get_targets_for_ems(source, :cloud_filter, ManageIQ::Providers, 'key_pairs')
+    targets = get_targets_for_ems(source, :cloud_filter, ManageIQ::Providers::CloudManager::AuthKeyPair, 'key_pairs')
     targets.each_with_object({}) { |kp, h| h[kp.id] = kp.name }
   end
 
diff --git a/spec/models/manageiq/providers/cloud_manager/provision_workflow_spec.rb b/spec/models/manageiq/providers/cloud_manager/provision_workflow_spec.rb
index 5f5bd9ec2e59..933ba2abc192 100644
--- a/spec/models/manageiq/providers/cloud_manager/provision_workflow_spec.rb
+++ b/spec/models/manageiq/providers/cloud_manager/provision_workflow_spec.rb
@@ -74,7 +74,10 @@
       FactoryGirl.create(:classification_cost_center_with_tags)
       admin.current_group.entitlement = Entitlement.create!(:filters => {'managed'   => [['/managed/cc/001']],
                                                                          'belongsto' => []})
-
+      2.times do |i|
+        kp = ManageIQ::Providers::CloudManager::AuthKeyPair.create(:name => "auth_#{i}")
+        ems.key_pairs << kp
+      end
       2.times { FactoryGirl.create(:availability_zone, :ems_id => ems.id) }
       2.times do
         FactoryGirl.create(:security_group, :name                  => "sgb_1",
@@ -84,11 +87,23 @@
                                         :supports_64_bit => true)
       ems.flavors << FactoryGirl.create(:flavor, :name => "m1.large", :supports_32_bit => false,
                                         :supports_64_bit => true)
-
+      tagged_key_pair = ems.key_pairs.first
       tagged_zone = ems.availability_zones.first
       tagged_flavor = ems.flavors.first
       Classification.classify(tagged_zone, 'cc', '001')
       Classification.classify(tagged_flavor, 'cc', '001')
+      Classification.classify(tagged_key_pair, 'cc', '001')
+    end
+
+    context "key_pairs" do
+      it "#get_targets_for_ems" do
+        expect(ems.key_pairs.size).to eq(2)
+        expect(ems.key_pairs.first.tags.size).to eq(1)
+        expect(ems.key_pairs.last.tags.size).to eq(0)
+        filtered = workflow.send(:get_targets_for_ems, ems, :cloud_filter, ManageIQ::Providers::CloudManager::AuthKeyPair,
+                                 'key_pairs')
+        expect(filtered.size).to eq(1)
+      end
     end
 
     context "availability_zones" do