Section 9 - AWS KMS

Question 1

What is AWS KMS?

Answer 1

AWS Key Management Service

• Managed
  
  • Managed service that makes it easy for you to create and control the encryption keys used to encrypt your data.
• Integrated
  
  • Seamlessly integrated with many AWS services to make encrypting data into those services as easy as checking a box.
• Key Types
  
  • Symmetric
    
    • A single encryption key that is used for both encryption and decrytpion operations
  • Asymmetric
    
    • A public and privae key pair that can be used for encryption and decryption to sign or verify operations
    • Use when doing encryption outside of AWS.
• Regional service

Question 2

AWS KMS Use cases?

Answer 2

Whyen to use KMS:

Whenever you are dealing with sensitive information

• Sensitive data that you want to keep secret
• Customer data
• Financial data
• Database passwords
• Credentials
• Secrets

Question 3

What is a CMK?

Answer 3

• Customer Master Key
  
  • Encrypt / Decrytp data up to 4KB
• What is it used for?
  
  • Generate / Encrypt / Decrypt the Data key.
• Data key
  
  • Used to encrypt / Decrypt your data.
  • The process of encrypting the data key to encrypt your data is called Envelope Encryption.
• Properties
  
  • Alias
    
    • Your application can refer to the alias when using the CMK.
  • Creation Date
    
    • The date and time when the CMK was created
  • Description
    
    • You can add your own descritpion to the describe the CMK
  • Key State
    
    • Enabled, Disabled, pending deletion, unavailable
  • Key Material
    
    • Customer-provided or AWS-provided
  • Stays Inside KMS
    
    • ​Can never be exported

Question 4

What is the difference Between AWS-Managed CMK and Customer-Managed CMK?

Answer 4

• AWS-Managed CMK
  
  • AWS-provided and AWS-managed CMK. Used on your behalf with the AWS services integrated with KMS.
• Customer-Managed CMK
  
  • You create,own and managed yourself.

Question 5

AWS KMS API Calls?

Answer 5

• aws kms encrypty
  
  • Encrypts plaintext into ciphertext by using a customer master key.
• aws kms decrypt
  
  • Decrypts ciphertext that was encrypted by an AWS KMS customer master key (CMK).
• aws kms re-encrypt
  
  • Decrypts ciphertext and then re-encrypts it entirely within AWS KMS(e.g. when you change the CMK or manually rotate route the CMK)
• aws kms enable-key-rotation
  
  • Enables automatic key rotation every 365 days.
• aws kms generate-data-key
  
  • uses the CMK to generate a Data-key to encrypt data > 4kb

Question 6

What is Envelope Encryption?

Answer 6

• A process for encrypting your data. it applies to files > 4 KB

Why Envelope Encryption?

• Network
  
  • When you encrypt data directly with KMS it must be transferred ober the network.
• Performance
  
  • With envelope encryption, only the data key goes over the network, not your data
• Benefits
  
  • The data key is used locally in your application or AWS service, avoid need to trasnfer large amounts of data to KMS