AWS Key Management Services (KMS)

When data is moved into the cloud, it is best to secure it at both the stages - when data is in transit and when the data is at rest and one of the services from AWS that can be foundational into dealing with keys for encryption is KMS or Key Management Service, mainly used to provide, store and manage encryption keys for data at rest.

Note that KMS also allows auditing of who used the KMS keys with the help of CloudTrail. It is also possible to exercise access control to KMS keys by creating usage policies.

KMS allows centralized key management that has compatibility to a variety of other AWS services.

AWS KMS facilitates the creation of both Symmetric key and Asymmetric keys (like for EC2 access over ssh)

KMS keys can be of two types:

• Customer Master Keys (CMKs) - It can be customer managed (uploaded by the customer or generated by KMS for the customer) or AWS-managed (generated in KMS by AWS whenever required). It can act as one of the input in generating unique data keys as well as used to encrypt and decrypt the generated data keys, i.e. CMKs can act as Key encryption keys and this process is known as Envelope Encryption

• Data Encryption Keys - It is also known as data keys, which is used to encrypt and decrypt the data. Note that master key never leaves the KMS and DEK generated each time is unique, for better security.

Using the keys in KMS, AWS encrypts and decrypts the data in S3 or s3 glacier or EBS or EFS or FSx or RedShift or RDS or Amazon EMR and even CloudTrail. This process is called Server-Side Encryption. Different flavours of SSE are as follows:

• Server Side Encryption using AWS Managed Keys (SSE-KMS) - Data Encryption key (DEK) is used, which itself is encrypted using Customer Master Key.

  • Example: To encrypt EBS volumes, KMS is used which holds the customer master keys (responsible for generating data keys) and data keys (for encryption of data on EBS volumes).

• Server Side Encryption using Customer Provided Encryption key (SSE-C) - The customer generated key is uploaded into KMS is used for encryption data directly, unlike in previous case, where DEK (data encryption key) is generated using Customer Master key

Note that in most data at rest cases, let's just say s3; so when data is uploaded into s3, the DEK is part of metadata for the encrypted s3 object in the bucket, therefore when required access to the encrypted object is requested, AWS s3 should be able able to get that quickly

There is something called Client-Side Encryption, where the client only supplies 256-bit key and key encrypting key and encrypt the data and encrypted blob is directly uploaded as it is (encrypted) in s3.

Please note that it is essential for KMS Administrative tasks such as

• Control access to IAM users and role that can administer and may or may not use the key

• Rotate the keys

• Disable keys and Re-enable keys when required

• Audit the usage of keys

AWS Console for KMS keys shows the following options:

Steps for triggering creation of AWS managed (KMS key/Customer Master key):

Steps for creating KMS generated Customer managed (KMS key/Customer Master key):

Steps for importing customer uploaded Customer managed (KMS key/Customer Master key):

<-will be added later->

Steps for using customer provided data encryption key:

<-will be added later->