📖 What is AWS Key Management Service (KMS)?
AWS Key Management Service (KMS) is a managed service that makes it easy to create and control the cryptographic keys used to encrypt your data. It integrates with most AWS services to provide seamless envelope encryption for data at rest.
"Understand the difference between AWS-managed keys and customer-managed keys (CMKs) for control over rotation schedules and access policies."
📚 Certification: AWS Certified Solutions Architect - Associate (SAA-C03)
🔑 What are the Key Concepts of AWS Key Management Service (KMS)?
- ▸ Customer Managed Keys (CMKs) provide full control over key policies, rotation schedules, and deletion, making them essential for meeting strict regulatory compliance requirements.
- ▸ AWS Managed Keys are free, automatically rotated by AWS, and integrated into services, but they offer limited control over the key's lifecycle and permissions.
- ▸ Envelope Encryption utilizes a Root Key to encrypt a Data Key, which then encrypts the actual data, reducing latency and avoiding KMS API limits.
- ▸ Key Policies are resource-based policies attached directly to the KMS key, defining which users or roles have permission to perform cryptographic operations.
- ▸ Key Rotation allows for the automatic update of the backing key material without needing to re-encrypt existing data, enhancing the overall security posture.
🎯 How does AWS Key Management Service (KMS) appear on the SAA-C03 Exam?
You may be asked to design a solution for a company with strict compliance rules requiring manual control over key rotation and deletion. In this case, you must select Customer Managed Keys over AWS Managed Keys to maintain full administrative control.
A scenario might describe a need to share encrypted S3 objects across different AWS accounts. Expect to configure a KMS key policy that grants the external account's IAM role 'kms:Decrypt' permissions to allow access.
Expect questions where you must choose between KMS and CloudHSM. If the requirement specifies FIPS 140-2 Level 3 hardware security or the need for single-tenant hardware control, CloudHSM is the correct choice over KMS.
❓ Frequently Asked Questions
What is the difference between Symmetric and Asymmetric keys in KMS?
Symmetric keys use a single key for both encryption and decryption, making them efficient for AWS service integration. Asymmetric keys provide a public/private key pair, allowing external users to encrypt data without having access to the private decryption key.
Can I recover data if I accidentally delete a KMS key?
No. Once the mandatory waiting period (7 to 30 days) expires and the key is deleted, the key material is gone forever. Any data encrypted with that key becomes permanently irrecoverable, emphasizing the importance of careful key management.