KMS and Encryption on AWS (ACG) Flashcards
What is AWS KMS?
AWS Key Management Service (KMS) manages your encryption keys.
What is CMK?
Customer Master Key (CMK)
What is a CMK alias?
Your app can refer to the alias when using the CMK.
You can export CMKs. True or False?
FALSE
CMKs can never be exported outside of KMS.
What are the basic steps to set up CMK?
- Create alias and description.
- Choose key material option - provide our own or KMS managed or CloudHSM
- Set up Key Administrative Permissions (IAM Users/Roles that can administer but not use the key through the KMS API)
- Key Usage Permissions - IAM Users/Roles that can use the key to encrypt and decrypt data
What are the different keys supported by KMS?
AWS-Managed CMK
Customer-Managed CMK
Data Key
What is the AWS KMS encrypt command?
aws kms encrypt
Encrypts plaintext into ciphertext by using a customer master key.
What is the AWS KMS decrypt command?
aws kms decrypt
What is the AWS KMS re-encrypt command?
aws kms re-encrypt
Decrypts ciphertext and re-encrypts with a new CMK if you wish.
What command would you use to automatically rotate your key annually?
aws kms enable-key-rotation
What command would you use to encrypt data over 4KB?
aws kms generate-data-key
What is Envelope Encryption?
Encrypting the key that encrypts our data.
The CMK is used to encrypt the data key (or envelope key).
The data key encrypts our data.
Used for encrypting anything over 4KB
Avoids sending all your data into KMS over the network to encrypt/decrypt directly.
Remember the GenerateDataKey API call.
What is the AWS managed service that allows you to create and control the encryption keys used to encrypt your data?
AWS KMS
Which command can you use to encrypt a plaintext file using a CMK?
aws kms encrypt
Envelope encryption is used to protect your encryption key. True or False?
TRUE
You cannot use AWS managed keys in cryptographic operations directly. True or False?
TRUE
What is the name of the practice of encrypting plaintext data with a data key, and then encrypting the data key under another key?
Envelope encryption
You would like KMS to rotate your encryption keys on a yearly basis. Which API command can you use to configure this?
aws kms enable-key-rotation
You are working on a project which requires a key management solution. Your security architect has confirmed that a multi-tenant solution is fine. Which solution do you recommend?
KMS
KMS is multi-tenant, whereas CloudHSM is dedicated hardware. S3 encryption and client-side encryption are not key management solutions.
You can export (copy out of the AWS KMS service in plaintext) your customer master key. True or False?
FALSE
You cannot export (copy out of the AWS KMS service in plaintext) your customer master key.
KMS encryption keys are global by default. True or False?
FALSE
KMS encryption keys are global by default.
