KMS 3

Question 1

Cross-Account, Cross-Region

Is KMS regional, zonal, global, or something else?

Answer 1

Regional (but you can do some cross-region things)

Question 2

Cross-Account, Cross-Region

How would you export a KMS key to move it to another region?

Answer 2

Can’t. Key material is locked away in a single region.

Question 3

Cross-Account, Cross-Region

Can you use a KMS key across accounts?

Answer 3

Not with AWS Managed keys, yes with Customer Managed Keys

Question 4

Cross-Account, Cross-Region

Can you use KMS keys in multiple regions?

Answer 4

Yes, Multi-Region Keys or make a cross-region API call

Question 5

Cross-Account, Cross-Region

What is identical across all keys that are part of a Multi-Region Key?

Answer 5

ID and key material (encrypt and decrypt anywhere)

Question 6

Cross-Account, Cross-Region

What is different across all keys that are part of a Multi-Region Key?

Answer 6

Key policies (permissions)

Question 7

Cross-Account, Cross-Region

Can an AWS-Managed Key be multi-region?

Answer 7

Never

Question 8

Cross-Account, Cross-Region

Can a CMK be multi-region?

Answer 8

Yes

Question 9

Cross-Account, Cross-Region

How does S3 (for example) use Multi-Region Keys for cross-region replication?

Answer 9

It doesn’t. It decrypts and re-encrypts objects in the target region with region-specific KMS keys

Question 10

Cross-Account, Cross-Region

How do you create a key in a new region and add it to a multi-region key?

Answer 10

Can’t: Multi-region keys set up when you create the key, replicated elsewhere.

Question 11

Cross-Account, Cross-Region

Help! A field was encrypted with a CMK in us-east-1, but I’m in us-west-1. What do I do?

Answer 11

Make a call from us-west-1 to us-east-1 and ask KMS to decrypt it. Just cross-region call.

Question 12

Cross-Account, Cross-Region

Can CMKs be migrated between regions?

Answer 12

No

Question 13

Cross-Account, Cross-Region

How do you change a key to be multi-region?

Answer 13

Can’t, decided when you create the key

Question 14

Cross-Account, Cross-Region

What can’t be used for a multi-region key?

Answer 14

Custom key stores

because they are backed by CloudHSM

Question 15

Cross-Account, Cross-Region

Can you delete a replica key?

Answer 15

Sure, goes away

Question 16

Cross-Account, Cross-Region

Can you delete a multi-region primary key?

Answer 16

Yes, but it removes all replica keys too

Question 17

Cross-Account, Cross-Region

What happens if the primary key fails?

Answer 17

Nothing, replica keys are complete copies

Question 18

Cross-Account, Cross-Region

Operationally, what do you do when a primary fails?

Answer 18

A replica becomed the primary

Question 19

Cross-Account, Cross-Region

How do you figure out the key ID for each replica?

Answer 19

All keys have the same ID (but different ARN prefixes since different regions)

Question 20

Cross-Account, Cross-Region

When should you use multi-region keys?

Answer 20

Multi-region distributed app: low-latency access in each region

Question 21

Asymmetric Keys

What do you use symmetric keys for?

Answer 21

Encrypt/decrypt

Question 22

Asymmetric Keys

What do you use asymmetric keys for?

Answer 22

Encrypt/decrypt OR sign/verify, but not both

Question 23

Asymmetric Keys

What can you do with RSA keys?

Answer 23

Encrypt/decrypt OR sign/verify, but not both

Question 24

Asymmetric Keys

What can you do with Elliptic Curve keys

Answer 24

sign/verify (only)

Question 25

Asymmetric Keys

How do you get an asymmetric key out of KMS?

Answer 25

Public key can come out, private key never leaves KMS

Question 26

Asymmetric Keys

How do you sign a file using KMS asymmetric key?

Answer 26

< 4kb -> send the whole thing, else send a hash of the large file

Question 27

Asymmetric Keys

How do you verify a file signed by a KMS asymmetric key?

Answer 27

Call KMS Verify API with file or hash

or do it yourself if you have the public key