![AWS Key Management Service](https://assets.community.aws/a/2gY2aFzI3ZtBha1zVGYGjaFJZxJ/Scre.webp)
AWS Key Management Service
AWS Key Management Service (KMS) acts like a secure vault for your encryption keys, letting you control who can access them and use them to encrypt your data in AWS.
Published May 16, 2024
Last Modified May 17, 2024
AWS Key Management Service (AWS KMS) is a managed service that simplifies the creation, management, and control of encryption keys used to secure your data across AWS services and applications. Here are the key aspects of AWS KMS:
- Create and manage cryptographic keys (symmetric and asymmetric).
- Control their use in your applications and AWS Services.
- Define key usage permissions (including cross account access).
- Track key usage in AWS CloudTrail (regulations & compliance).
- Integrates with almost all AWS services that need data encryption.
- Automatically rotate master keys once a year.
- Schedule key deletion to verify if the key is used., Mandatory minimum wait period of 7 days (max-30 days).
![](https://assets.community.aws/a/2gY2XsJln9rdlAMuom6XshwfwQ4/Scre.webp)
- Create Customer Master Key. Map to AWS service (S3)
- Steps
- Data sent to S3.
- S3 receives data keys from KMS.
- S3 encrypts data.
- Stores encrypted data & data key.
- Remember
- CMK never leaves KMS.
- Encryption of data key - KMS using CMK.
- Encryption of data - AWS Service - Amazon S3 using data key.
![](https://assets.community.aws/a/2gY3dtVPzP0RD57SRmA4xnXslj5/Scre.webp)
- The process KMS uses for encryption is called Envelope Encryption.
- Data is encrypted using data key.
- Data key is encrypted using Master key.
- Master key never leaves KMS.
- KMS encrypts small pieces of data (usually data keys) <4 KB.
(https://docs.aws.amazon.com/kms/latest/developerguide/)
![](https://assets.community.aws/a/2gY4FlBIahJhNcUg08TY1YWDakg/Scre.webp)
- AWS service (Amazon S3) sends encrypted data key to KMS.
- KMS uses Customer Master Key (CMK) to decrypt and return plain-text data key.
- AWS service (Amazon S3) uses the plain-text data key to perform decryption.
- Note: Remove plain-text data key from memory asap.
- Note: AWS service needs IAM permissions to use the CMK.
![](https://assets.community.aws/a/2gY4YIUIgSfniZhLfiQRZk3o1q7/Scre.webp)
- Enhanced security: KMS manages the lifecycle of your keys, reducing the risk of unauthorized access or loss.
- Simplified key management: No need to manage keys yourself; KMS handles rotation, backup, and deletion.
- Compliance support: KMS helps meet regulatory compliance requirements for data security.
Anyone storing sensitive data in AWS can benefit from KMS. It's especially useful for:
- Databases: Encrypt databases containing sensitive information like financial records or personal data.
- S3 Buckets: Securely store files in S3 buckets with KMS-managed encryption keys.
- EC2 Instances: Encrypt data on your EC2 instances using KMS keys.
AWS KMS Documentation: https://docs.aws.amazon.com/kms/