KMS 1 Flashcards
KMS
Key feature of KMS, the Big Thing?
Keys in KMS never leave KMS.
KMS
What’s the technical standard for keys?
important
FIPS 140-2 L2
must know down to the “L2” portion
KMS
Why does the “L2” in the FIPS standard matter?
important
KMS only does L2; need CloudHSM for higher security levels
KMS
Why trust KMS? Just keys stored on disk somewhere…
KMS uses hardware security modules (HSMs) behind the scenes
KMS
Strong statement about all data at rest in KMS?
No data in KMS is ever stored on disk unencrypted
AWS Managed Keys
Example of AWS managed keys?
“aws/redshift”, “aws/sqs”, “aws/lambda”
AWS Managed Keys
Are AWS Managed Keys symmetric, asymmetric, or both?
Only symmetric
AWS Managed Keys
What are AWS Managed Keys used for?
Services create and use them directly
AWS Managed Keys
Why would you change the Key Policy on an AWS Managed Key?
You can’t (you can see it, but not change it)
AWS Managed Keys
What can you do with AWS Managed Keys?
Nearly nothing. AWS Services use them.
AWS Managed Keys
Are AWS Managed Keys regional, global, or something else?
Per-service, per-region, per-account
AWS Managed Keys
How can you share KMS Managed Keys in an Organization between accounts?
Can’t
AWS Managed Keys
Cost for AWS Managed Keys?
Pay per-use
AWS Managed Keys
Why don’t I have a aws/sqs key?
You haven’t used SQS in this account in this region yet
created on 1st use
AWS Managed Keys
What if I don’t want a service to use the default AWS managed key?
Some services allow you to use a CMK (like SSE-KMS for S3)
Customer Managed Keys
How do you create Customer Managed Keys?
AWS creates the key material (default), or upload your own key material
Customer Managed Keys
Cost structure for CMKs?
AWS-Managed pay only per-use fee, CMKs pay monthly + per-use fee
Customer Managed Keys
What is a Customer Master Key?
Old name for Customer Managed Key
Customer Managed Keys
Are CMKs regional, global, or something else?
Per-region, per-account
Customer Managed Keys
Are CMKs symmetric, asymmetric, or both?
Can be either
Encrypting and Decrypting
Max amount of data that KMS will encrypt or decrypt with KMS keys?
4 kb
Encrypting and Decrypting
What do you get back when you send in data to encrypt?
Cipher text that also includes the ID of the key used to encrypt it
Encrypting and Decrypting
Specific steps inside KMS to encrypt source data?
Reads encrypted key from disk > decrypts the key in memory > encrypts source data
Digital Signing
Why bother with KMS to handle asymmetric keys for signatures?
Private key material in HSMs, use key policies to control access
