AWS KMS & Data Encryption
7 questions found
What is AWS KMS and what role does it play in encrypting data across AWS services?
Beginner
AWS Key Management Service, or KMS, is a fully managed service that lets you create and control cryptographic keys used to encrypt data across many AWS services, such as S3, EBS, and RDS, handling the complex work of securely generating, storing, and managing the lifecycle of encryption keys so you can enable encryption throughout your applications without needing to build and operate your own key management infrastructure.
aws kms create-key --description 'My application encryption key'
Real-world example
A company enables encryption on its S3 buckets and RDS databases using a KMS managed key, ensuring sensitive customer data is encrypted at rest without needing to build any custom key management system themselves.
Common follow-ups: What is the difference between AWS managed keys and customer managed keys in KMS?;How does KMS charge for key usage?
S3 & Storage;RDS & Databases
What is the difference between a customer managed key and an AWS managed key in KMS?
Beginner
A customer managed key is a KMS key that you create and fully control, including defining its key policy, rotation schedule, and who can use it, while an AWS managed key is automatically created and managed by AWS on your behalf for a specific service, offering less control and customization but requiring no setup effort, meaning customer managed keys are generally chosen when you need fine grained control over exactly who can use a key or need to share it across specific accounts or services.
aws kms create-key --policy file://key-policy.json --description 'Customer managed key for finance data'
Real-world example
A finance department creates its own customer managed KMS key with a strict key policy limiting usage to only specific finance team IAM roles, rather than relying on the default AWS managed key used broadly across the rest of the organization.
Common follow-ups: Can an AWS managed key be shared across multiple AWS accounts?;How do you decide when a customer managed key is necessary instead of an AWS managed key?
IAM;AWS Organizations & Multi Account Strategy
How does envelope encryption work in KMS, and why is it used instead of encrypting large amounts of data directly with a KMS key?
Intermediate
Envelope encryption uses a KMS master key to encrypt a smaller, unique data key, which is then used to actually encrypt your data locally, meaning the potentially large data itself never needs to be sent to KMS for encryption, only the small data key does, significantly improving performance and reducing the number of calls made to KMS compared to encrypting large volumes of data directly through the service itself.
response = kms_client.generate_data_key(KeyId='alias/my-key', KeySpec='AES_256')
plaintext_key = response['Plaintext']
encrypted_key = response['CiphertextBlob']
Real-world example
An application encrypting large video files locally generates a unique data key from KMS for each file, encrypts the file using that data key on the local machine, and stores only the small encrypted version of the data key alongside the file, avoiding the need to send massive file contents through KMS itself.
Common follow-ups: What is the size limit for data that can be encrypted directly by a KMS key without envelope encryption?;How is the encrypted data key later used to decrypt the original data?
S3 & Storage;Amazon EFS (Elastic File System)
How do KMS key policies and grants control who can use a specific encryption key?
Intermediate
A key policy is the primary mechanism for controlling access to a KMS key, defining exactly which IAM principals can perform actions such as encrypting, decrypting, or managing the key, and it must explicitly grant access since KMS key policies do not automatically inherit permissions the way some other AWS resources do, while grants provide a more temporary and delegated way to give specific permissions to a principal, often used for short lived or programmatic access scenarios.
aws kms put-key-policy --key-id abc123 --policy-name default --policy file://updated-key-policy.json
Real-world example
A company restricts its most sensitive KMS key's policy to allow decryption only from a specific application's IAM role, ensuring that even administrators with broad account permissions cannot decrypt that particular sensitive data without an explicit, separately granted exception.
Common follow-ups: Why don't KMS key policies automatically inherit permissions like other AWS resource policies often do?;What is the difference between a key policy and a grant in terms of how long access lasts?
IAM;AWS CloudTrail & Auditing
How does automatic key rotation work in KMS, and why is it a recommended security practice?
Intermediate
KMS supports automatic annual rotation for customer managed keys, which generates new underlying cryptographic material for the key every year while keeping the same key identifier, meaning existing encrypted data remains fully accessible and no application changes are needed, and this rotation practice reduces the risk associated with a single cryptographic key being used indefinitely, limiting the amount of data that could be exposed if a key were ever somehow compromised.
aws kms enable-key-rotation --key-id abc123
Real-world example
A company enables automatic annual key rotation on all of its customer managed KMS keys as a standard security practice, ensuring cryptographic material is refreshed regularly without requiring any manual intervention or application downtime.
Common follow-ups: Does key rotation affect the ability to decrypt data that was encrypted before the rotation occurred?;How does automatic rotation differ from manually creating an entirely new key?
AWS Security Hub & GuardDuty;AWS CloudTrail & Auditing
How can KMS multi region keys support encryption and decryption of the same data across multiple AWS regions without needing to re encrypt data during a cross region transfer?
Advanced
KMS multi region keys let you create a primary key in one region and replicate it as related keys in other regions, sharing the same underlying key material, meaning data encrypted with the primary key in one region can be decrypted directly using the replica key in another region without requiring you to decrypt and re encrypt the data during a cross region migration or in a multi region disaster recovery scenario.
aws kms replicate-key --key-id abc123 --replica-region eu-west-1
Real-world example
A company running a multi region disaster recovery setup uses KMS multi region keys so that encrypted database backups replicated from its primary region to a secondary region can be decrypted immediately during a failover, without any complex re encryption process.
Common follow-ups: What happens if you need to rotate a multi region key, does it rotate consistently across all regions?;Are there any actions that cannot be performed on a replica key compared to the primary key?
AWS Backup & Disaster Recovery;AWS Global Infrastructure (Regions
AZs & Edge Locations)
How does AWS CloudHSM differ from KMS, and when would an organization need the additional control it provides?
Advanced
AWS CloudHSM provides dedicated, single tenant hardware security modules that give you complete, exclusive control over the cryptographic keys and hardware, meeting certain strict regulatory or compliance requirements that specifically mandate the use of dedicated hardware security modules, whereas KMS uses shared multi tenant hardware managed entirely by AWS, which is sufficient and far simpler for the vast majority of use cases but does not offer the same level of exclusive physical control that some highly regulated industries specifically require.
aws cloudhsmv2 create-cluster --hsm-type hsm1.medium --subnet-ids subnet-12345
Real-world example
A payment processing company operating under strict regulatory requirements that mandate dedicated hardware security modules uses CloudHSM instead of standard KMS, satisfying an auditor's specific requirement for exclusive, non shared cryptographic hardware.
Common follow-ups: What is the cost difference between using CloudHSM and standard KMS?;Can CloudHSM be integrated with KMS as a custom key store?
AWS Security Hub & GuardDuty;IAM