KMS 2 Flashcards
Data Encryption Keys
How do you get around the 4 kb limit on plaintext?
Data Encryption Keys: a key you take away from KMS and use elsewhere (like EBS)
Data Encryption Keys
Where do you create a DEK?
Have to use the API (not available on the console)
Data Encryption Keys
Are DEKs symmetric or asymmetric?
Either! Separate APIs for both
Data Encryption Keys
What do you get back when you call GenerateDataKey?
Plaintext version of the DEK and a version encrypted with the KMS key that created it
Data Encryption Keys
Where are DEKs stored?
Nowhere (at lest not in KMS)
Data Encryption Keys
What’s the typical use case after calling GenerateDataKey?
Use plaintext to encrypt something, store ciphertext and encrypted key together for later use
Data Encryption Keys
What happens to DEKs if you rotate the KMS key that created them?
Encrypted DEKs aren’t changed. They are out of the control of KMS.
Data Encryption Keys
How does KMS encrypt using DEKs?
It doesn’t: that’s the whole point of DEKs: you take the key elsewhere and do it yourself
Data Encryption Keys
How do you decrypt something with a DEK?
Pass encrypted DEK to KMS, get plaintext key, use it to decrypt data
Key Rotation
Can you auto-rotate AWS Managed keys?
Yes
Key Rotation
Can you turn-off auto-rotate for AWS Managed Keys?
No
Key Rotation
Can you auto-rotate Customer Managed Keys?
Only ones with AWS-provided key material
Key Rotation
Can you turn off auto-rotate for customer managed keys?
Yes
Key Rotation
How often do keys auto-rotate, if enabled?
Once every year
Key Rotation
What happens when a KMS key is auto-rotated?
KMS keeps all previous key material so previously-encrypted material can still be decrypted
Key Rotation
What happens to the key ID when the key is rotated?
Stays the same
Key Rotation
Do Multi-region keys auto-rotate?
Yes, if a single-region key of the same type can be auto-rotated
Key Policies
What is the default permissions on a key?
Key Policy with allow “kms:*” on “root” arn (every principal in the account)
Key Policies
What are the limitations on what you can put in a key Resource Policy?
Trick: Key Policies aren’t Resource Policies, they’re entirely different.
Key Policies
Can a key allow some principals to encrypt but not decrypt?
Sure. Granular permission model
Key Policies
How do you fix a key policy that denies access to your account?
Have to use root creds
Key Policies
What happens if key policy doesn’t allow an IAM User, but the User’s permissions do allow?
Not allowed: KMS key policies are special – they’re not Resource Policies.
Key Policies
What’s a good mental model for how Key Policies work?
important
They’re like cross-account Resource policies: both Key Policy and user policy have to allow
Key Policies
What’s a good practice for systems that aren’t high-security?
Key policy trusts “root”, meaning all principals in the account, each Role/User grants perms
