Key Management Service KMS

In this post, I make available my notes about Key Management Service (KMS) made from Adrian Cantrill’s course AWS Certified Solutions Architect – Associate (SAA-C02). The Q&A session below can be used to validate your knowledge or create Flashcards for study. Since this is a piece of knowledge in construction there may be mistakes, drop a comment for any suggestions.

• KMS is part of the AWS public zone and exists as a separate service in each region
• KMS allows you to create, store and manage cryptography keys.
• It can handle Symmetric and Asymmetric Keys and has cryptographic operations for encrypting, decrypting, and others.
• It is important to know that keys never leave the KMS Service.
• The KMS provides the security standard FIPS 140-2 (L2) compliance service.
• The main thing KMS manages is the CMK (Customer Master Key)
• KMS is a container for physical master keys
• There are two types of CMK, AWS-managed and customer-managed.
• AWS-managed CMK is created automatically when you enable server-side encryption of a resource, customer-managed CMK is created by you when necessary.
• Key material is like a code used to encrypt and decrypt data.
• CMKs support rotation: Process when the physical material is changed. For AWS-managed CMK the rotation happens once every 3 years, with Customer-managed CMK rotation is optional but once enable it happens once a year
• CMKS logical is made of: ID, date, policy, description, state (active or not).
• Aliases: Allow creation alias at the region that points to a CMK and your application can use that alias instead of the direct CMK name. This allows you to change the CMK without changing the application.
• Key Policies is like a resource policy for keys and revert CMK has its Key Policy.
• For IAM users to use KMS he needs: Key Policy + IAM Policy
• The Data Encryption Key (DEK) is a type of key that KMS can generate using a CMK
• The GenerateDateKey operation generate keys (DEK) that work for bigger than 4KB
• KMS never stores the DEK, it provides to you and discards it because it does not use it, you are responsible to use DEK to encrypt and decrypt data
• To encrypt data outside of KMS: Generate the plain data key and ciphertext version of the keys using the GenerateDataKey Operation, use the plain key to encrypt the data and discard it, and store the encrypted key with the data.
• To decrypt data outside KMS: Get the encrypted key and use the decrypt operation of KMS to receive the plaintext of the key, use the plaintext data key to decrypt the data and discard it.

Read mover about KMS on AWS.

See more content like this by accessing the Study Note Tag or AWS Category inside this blog or know my methodology of studying for AWS certification.