Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

DVA > KMS > Flashcards

KMS Flashcards

1
Q

What is Encryption in flight?

A

Data is encrypted before sending and decrypted after receiving
• SSL certificates help with encryption (HTTPS)
• Encryption in flight ensures no MITM (man in the middle attack) can happen

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is server side encryption at rest?

A

• Data is encrypted after being received by the server
• Data is decrypted before being sent
• It is stored in an encrypted form thanks to a key (usually a data key)
• The encryption / decryption keys must be managed somewhere and
the server must have access to it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is client side encryption?

A
  • Data is encrypted by the client and never decrypted by the server
  • Data will be decrypted by a receiving client
  • The server should not be able to decrypt the data
  • Could leverage Envelope Encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Anytime you hear “encryption” for an AWS service what is it?

A

KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is KMS?

A

AWS Key Management Service (AWS KMS) is a managed service that makes it easy for you to create and control customer master keys (CMKs), the encryption keys used to encrypt your data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the CMK types?

A

Symmetric (AES-256 keys)

Asymmetric (RSA and ECC key pairs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What type of CMK use AWS services that are integrated with KMS?

A

Symmetric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Symmetric CMK?

A

single encryption key that is used to Encrypt and Decrypt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Asymmetric CMK?

A

Public (Encrypt) and Private Key (Decrypt) pair (used by SSH)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is used for Asymmetric CMK?

A

for encryption outside of AWS by users who can’t call the KMS API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the 3 types of CMK that you can create in KMS?

A
  • AWS Managed Service Default CMK: free
  • User Keys created in KMS: $1 / month
  • User Keys imported (must be 256-bit symmetric key): $1 / month
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are you able to do with your KMS keys and policies?

A
  • Able to fully manage the keys & policies:
  • Create
  • Rotation policies
  • Disable
  • Enable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How can you retrieve the key used to encrypt data by KMS?

A

you can never retrieve it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the max data allowed by KMS per call?

A

4 KB, otherwise use envelope encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Are KMS keys multi regions?

A

no, when you copy something encrypted cross region KMS reencrypt with a new key for the other region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are KMS Key Policies?

A

Control access to KMS keys, “similar” to S3 bucket policies, but you cannot access KMS without them and there is a default one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What you must do to give access to KMS to someone?

A

o Make sure the Key Policy allows the user

o Make sure the IAM Policy allows the API calls

18
Q

How should you copy EBS snapshots accross regions?

A

1- Encrypt the volume using a KMS Key A
2- Create a snapshot
3- KMS Re-Encrypt the snapshot using a KMS Key B from Region B
4- Create volume from snapshot

19
Q

How is the default KMS Key Policy?

A

o Created if you don’t provide a specific KMS Key Policy
o Complete access to the key to the root user = entire AWS account
o Gives access to the IAM policies to the KMS key

20
Q

How is a custom KMS Key Policy?

A

o Define users, roles that can access the KMS key
o Define who can administer the key
o Useful for cross-account access of your KMS key

21
Q

How can you copy snapshots accross acounts?

A
  1. Create a Snapshot, encrypted with your own CMK
  2. Attach a KMS Key Policy to authorize cross-account access
  3. Share the encrypted snapshot
  4. (in target) Create a copy of the Snapshot, encrypt it with a KMS Key in your account
  5. Create a volume from the snapshot
22
Q

What will help us to encrypt more than 4 KB by using Envelop Encryption?

A

The main API that will help us is the GenerateDataKey API

23
Q

What is the Encryption SDK?

A

The AWS Encryption SDK is a client-side encryption library designed to make it easy for everyone to encrypt and decrypt data using industry standards and best practices. It also exists as a CLI tool we can install

24
Q

What useful feature is provided by the Encryption SDK?

A

Data Key Caching:
o re-use data keys instead of creating new ones for each encryption
o Helps with reducing the number of calls to KMS with a security trade-off

25
Q

What uses the Encryption SDK for data key caching?

A

Use LocalCryptoMaterialsCache (max age, max bytes, max number of messages)

26
Q

What are the main APIs in KMS?

A
  • Encrypt
  • GenerateDataKey
  • GenerateDataKeyWithoutPlaintext
  • Decrypt
  • GenerateRandom
27
Q

What is Encrypt API in KMS?

A

encrypt up to 4 KB of data through KMS

28
Q

What is GenerateDataKey API in KMS?

A

generates a unique symmetric data key (DEK)
o returns a plaintext copy of the data key
o AND a copy that is encrypted under the CMK that you specify

29
Q

What is GenerateDataKeyWithoutPlaintext API in KMS?

A

o Generate a DEK to use at some point (not immediately)

o DEK that is encrypted under the CMK that you specify (must use Decrypt later)

30
Q

What is Decrypt API in KMS?

A

decrypt up to 4 KB of data (including Data Encryption Keys)

31
Q

What is GenerateRandom API in KMS?

A

Returns a random byte string

32
Q

What happens when you exceed a request quota in KMS?

A

When you exceed a request quota, you get a ThrottlingException
• For cryptographic operations, they share a quota
• This includes requests made by AWS on your behalf (ex: SSE-KMS)

33
Q

How can you respond to KMS Throttling exceptions?

A
  • use exponential backoff (backoff and retry)
  • For GenerateDataKey, consider using key caching from the Encryption SDK
  • You can request a Request Quotas increase through API or AWS support
34
Q

What API calls will leverage SSE-KMS?

A
  • SSE-KMS leverages the GenerateDataKey & Decrypt KMS API calls
  • These KMS API calls will show up in CloudTrail, helpful for logging
35
Q

What you need to perform SSE-KMS encryption?

A

To perform SSE-KMS, you need:
o A KMS Key Policy that authorizes the user / role
o An IAM policy that authorizes access to KMS
o Otherwise you will get an access denied error

36
Q

How can you force SSL to be used in your bucket?

A

To force SSL, create an S3 bucket policy with a DENY on the condition aws:SecureTransport = false

37
Q

What would happen if you allow on aws:SecureTransport = true in your bucket policy?

A

Using an allow on aws:SecureTransport = true would allow anonymous GetObject if using SSL

38
Q

How could you force SSE-KMS encryption in your bucket policy?

A
  1. Deny incorrect encryption header: make sure it includes aws:kms (== SSE-KMS)
  2. Deny no encryption header to ensure objects are not uploaded un-encrypted
    • Note: could swap 2) for S3 default encryption of SSE-KMS
39
Q

How can you encrypt CloudWatch logs with KMS keys?

A

Encryption is enabled at the log group level, by associating a CMK with a log group, either when you create the log group or after it exists.

40
Q

How can you associate a CMK with a log group using the CloudWatch console?

A

You cannot associate a CMK with a log group using the CloudWatch console. You must use the CloudWatch Logs API

41
Q

How can you associate a CMK with a log group using the CloudWatch Logs API?

A

associate-kms-key API call if the log group already exists

create-log-group API call if the log group doesn’t exist yet

42
Q

What you need to do in KMS to integrate it with CloudWatch Logs?

A

You need to edit the KMS Key Policy

DVA (61 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions