AWS Key Management Store (KMS) Quiz

AWS Key Management Store (KMS)

• AWS KMS is a managed service for encrypting data, providing key storage, management, and auditing.
• Centrally manages and securely stores AWS KMS keys, previously known as customer master keys (CMKs).

KMS Keys

• KMS keys consist of metadata including key ID, creation date, description, and key state.
• Supports both symmetric and asymmetric keys, with symmetric keys remaining encrypted within AWS KMS.
• A KMS key can encrypt data up to 4KB and is unable to be exported from KMS.

Key Types

• Customer Managed KMS keys: Created and managed within user accounts; users have complete control and incur monthly fees.
• AWS Managed KMS keys: Created and managed by integrated AWS services; users cannot modify them and incur no monthly fees, but charges may apply for excessive use.
• AWS Owned KMS keys: Managed by AWS services, invisible to users; no fees are associated, and they don’t count against account limits.

Data Encryption Keys

• Data keys are used for encrypting large amounts of data and other data encryption keys.
• AWS KMS does not store or manage these data keys; they must be handled externally.
• The GenerateDataKey API creates data encryption keys using KMS keys.

KMS Functionality

• Utilizes hardware security modules (HSMs) for protecting KMS keys.
• Integrates seamlessly with various AWS services, such as Lambda, S3, EBS, DynamoDB, and SQS.
• All requests to master keys are logged in AWS CloudTrail for tracking usage.

Key Management and Policies

• Users determine usage policies for KMS keys to specify which users can encrypt/decrypt data.
• KMS supports both symmetric and asymmetric keys but is limited to encryption at rest (not in transit).
• Key management functions include creating, enabling, disabling keys, and deleting them after a configurable waiting period.

Custom Key Store

• Combines AWS CloudHSM controls with AWS KMS ease of use, allowing users to generate key material within a CloudHSM cluster.
• Ensures keys remain secure and in plaintext only within HSMs.

Key Deletion

• Users can schedule deletion of customer master keys with a waiting period of 7 to 30 days, allowing assessment of impact before permanent deletion.
• Default waiting period is 30 days, and deletion can be canceled during this time.

Important APIs

• Encrypt and Decrypt for encrypting/decrypting data.
• Re-encrypt for changing the encryption key used.
• GenerateDataKey for creating a data encryption key.

KMS Envelope Encryption

• Integrates with AWS clients using envelope encryption for better data security.
• Data keys are encrypted using master keys through KMS to secure the data itself.

Limits and Recommendations

• Up to 1000 KMS keys can be created per account per region, including both enabled and disabled keys.
• It’s advisable to delete disabled keys no longer in use to manage limits efficiently.
• There are no restrictions on the number of data keys that can be generated from master keys.

AWS Key Management Store (KMS)

• AWS KMS is a managed service for encrypting data, providing key storage, management, and auditing.
• Centrally manages and securely stores AWS KMS keys, previously known as customer master keys (CMKs).

KMS Keys

• KMS keys consist of metadata including key ID, creation date, description, and key state.
• Supports both symmetric and asymmetric keys, with symmetric keys remaining encrypted within AWS KMS.
• A KMS key can encrypt data up to 4KB and is unable to be exported from KMS.

Key Types

• Customer Managed KMS keys: Created and managed within user accounts; users have complete control and incur monthly fees.
• AWS Managed KMS keys: Created and managed by integrated AWS services; users cannot modify them and incur no monthly fees, but charges may apply for excessive use.
• AWS Owned KMS keys: Managed by AWS services, invisible to users; no fees are associated, and they don’t count against account limits.

Data Encryption Keys

• Data keys are used for encrypting large amounts of data and other data encryption keys.
• AWS KMS does not store or manage these data keys; they must be handled externally.
• The GenerateDataKey API creates data encryption keys using KMS keys.

KMS Functionality

• Utilizes hardware security modules (HSMs) for protecting KMS keys.
• Integrates seamlessly with various AWS services, such as Lambda, S3, EBS, DynamoDB, and SQS.
• All requests to master keys are logged in AWS CloudTrail for tracking usage.

Key Management and Policies

• Users determine usage policies for KMS keys to specify which users can encrypt/decrypt data.
• KMS supports both symmetric and asymmetric keys but is limited to encryption at rest (not in transit).
• Key management functions include creating, enabling, disabling keys, and deleting them after a configurable waiting period.

Custom Key Store

• Combines AWS CloudHSM controls with AWS KMS ease of use, allowing users to generate key material within a CloudHSM cluster.
• Ensures keys remain secure and in plaintext only within HSMs.

Key Deletion

• Users can schedule deletion of customer master keys with a waiting period of 7 to 30 days, allowing assessment of impact before permanent deletion.
• Default waiting period is 30 days, and deletion can be canceled during this time.

Important APIs

• Encrypt and Decrypt for encrypting/decrypting data.
• Re-encrypt for changing the encryption key used.
• GenerateDataKey for creating a data encryption key.

KMS Envelope Encryption

• Integrates with AWS clients using envelope encryption for better data security.
• Data keys are encrypted using master keys through KMS to secure the data itself.

Limits and Recommendations

• Up to 1000 KMS keys can be created per account per region, including both enabled and disabled keys.
• It’s advisable to delete disabled keys no longer in use to manage limits efficiently.
• There are no restrictions on the number of data keys that can be generated from master keys.

AWS Key Management Store (KMS)

• AWS KMS is a managed service for encrypting data, providing key storage, management, and auditing.
• Centrally manages and securely stores AWS KMS keys, previously known as customer master keys (CMKs).

KMS Keys

• KMS keys consist of metadata including key ID, creation date, description, and key state.
• Supports both symmetric and asymmetric keys, with symmetric keys remaining encrypted within AWS KMS.
• A KMS key can encrypt data up to 4KB and is unable to be exported from KMS.

Key Types

• Customer Managed KMS keys: Created and managed within user accounts; users have complete control and incur monthly fees.
• AWS Managed KMS keys: Created and managed by integrated AWS services; users cannot modify them and incur no monthly fees, but charges may apply for excessive use.
• AWS Owned KMS keys: Managed by AWS services, invisible to users; no fees are associated, and they don’t count against account limits.

Data Encryption Keys

• Data keys are used for encrypting large amounts of data and other data encryption keys.
• AWS KMS does not store or manage these data keys; they must be handled externally.
• The GenerateDataKey API creates data encryption keys using KMS keys.

KMS Functionality

• Utilizes hardware security modules (HSMs) for protecting KMS keys.
• Integrates seamlessly with various AWS services, such as Lambda, S3, EBS, DynamoDB, and SQS.
• All requests to master keys are logged in AWS CloudTrail for tracking usage.

Key Management and Policies

• Users determine usage policies for KMS keys to specify which users can encrypt/decrypt data.
• KMS supports both symmetric and asymmetric keys but is limited to encryption at rest (not in transit).
• Key management functions include creating, enabling, disabling keys, and deleting them after a configurable waiting period.

Custom Key Store

• Combines AWS CloudHSM controls with AWS KMS ease of use, allowing users to generate key material within a CloudHSM cluster.
• Ensures keys remain secure and in plaintext only within HSMs.

Key Deletion

• Users can schedule deletion of customer master keys with a waiting period of 7 to 30 days, allowing assessment of impact before permanent deletion.
• Default waiting period is 30 days, and deletion can be canceled during this time.

Important APIs

• Encrypt and Decrypt for encrypting/decrypting data.
• Re-encrypt for changing the encryption key used.
• GenerateDataKey for creating a data encryption key.

KMS Envelope Encryption

• Integrates with AWS clients using envelope encryption for better data security.
• Data keys are encrypted using master keys through KMS to secure the data itself.

Limits and Recommendations

• Up to 1000 KMS keys can be created per account per region, including both enabled and disabled keys.
• It’s advisable to delete disabled keys no longer in use to manage limits efficiently.
• There are no restrictions on the number of data keys that can be generated from master keys.

AWS Key Management Store (KMS)

• AWS KMS is a managed service for encrypting data, providing key storage, management, and auditing.
• Centrally manages and securely stores AWS KMS keys, previously known as customer master keys (CMKs).

KMS Keys

• KMS keys consist of metadata including key ID, creation date, description, and key state.
• Supports both symmetric and asymmetric keys, with symmetric keys remaining encrypted within AWS KMS.
• A KMS key can encrypt data up to 4KB and is unable to be exported from KMS.

Key Types

• Customer Managed KMS keys: Created and managed within user accounts; users have complete control and incur monthly fees.
• AWS Managed KMS keys: Created and managed by integrated AWS services; users cannot modify them and incur no monthly fees, but charges may apply for excessive use.
• AWS Owned KMS keys: Managed by AWS services, invisible to users; no fees are associated, and they don’t count against account limits.

Data Encryption Keys

• Data keys are used for encrypting large amounts of data and other data encryption keys.
• AWS KMS does not store or manage these data keys; they must be handled externally.
• The GenerateDataKey API creates data encryption keys using KMS keys.

KMS Functionality

• Utilizes hardware security modules (HSMs) for protecting KMS keys.
• Integrates seamlessly with various AWS services, such as Lambda, S3, EBS, DynamoDB, and SQS.
• All requests to master keys are logged in AWS CloudTrail for tracking usage.

Key Management and Policies

• Users determine usage policies for KMS keys to specify which users can encrypt/decrypt data.
• KMS supports both symmetric and asymmetric keys but is limited to encryption at rest (not in transit).
• Key management functions include creating, enabling, disabling keys, and deleting them after a configurable waiting period.

Custom Key Store

• Combines AWS CloudHSM controls with AWS KMS ease of use, allowing users to generate key material within a CloudHSM cluster.
• Ensures keys remain secure and in plaintext only within HSMs.

Key Deletion

• Users can schedule deletion of customer master keys with a waiting period of 7 to 30 days, allowing assessment of impact before permanent deletion.
• Default waiting period is 30 days, and deletion can be canceled during this time.

Important APIs

• Encrypt and Decrypt for encrypting/decrypting data.
• Re-encrypt for changing the encryption key used.
• GenerateDataKey for creating a data encryption key.

KMS Envelope Encryption

• Integrates with AWS clients using envelope encryption for better data security.
• Data keys are encrypted using master keys through KMS to secure the data itself.

Limits and Recommendations

• Up to 1000 KMS keys can be created per account per region, including both enabled and disabled keys.
• It’s advisable to delete disabled keys no longer in use to manage limits efficiently.
• There are no restrictions on the number of data keys that can be generated from master keys.

AWS Key Management Store (KMS)

• AWS KMS is a managed service for encrypting data, providing key storage, management, and auditing.
• Centrally manages and securely stores AWS KMS keys, previously known as customer master keys (CMKs).

KMS Keys

• KMS keys consist of metadata including key ID, creation date, description, and key state.
• Supports both symmetric and asymmetric keys, with symmetric keys remaining encrypted within AWS KMS.
• A KMS key can encrypt data up to 4KB and is unable to be exported from KMS.

Key Types

• Customer Managed KMS keys: Created and managed within user accounts; users have complete control and incur monthly fees.
• AWS Managed KMS keys: Created and managed by integrated AWS services; users cannot modify them and incur no monthly fees, but charges may apply for excessive use.
• AWS Owned KMS keys: Managed by AWS services, invisible to users; no fees are associated, and they don’t count against account limits.

Data Encryption Keys

• Data keys are used for encrypting large amounts of data and other data encryption keys.
• AWS KMS does not store or manage these data keys; they must be handled externally.
• The GenerateDataKey API creates data encryption keys using KMS keys.

KMS Functionality

• Utilizes hardware security modules (HSMs) for protecting KMS keys.
• Integrates seamlessly with various AWS services, such as Lambda, S3, EBS, DynamoDB, and SQS.
• All requests to master keys are logged in AWS CloudTrail for tracking usage.

Key Management and Policies

• Users determine usage policies for KMS keys to specify which users can encrypt/decrypt data.
• KMS supports both symmetric and asymmetric keys but is limited to encryption at rest (not in transit).
• Key management functions include creating, enabling, disabling keys, and deleting them after a configurable waiting period.

Custom Key Store

• Combines AWS CloudHSM controls with AWS KMS ease of use, allowing users to generate key material within a CloudHSM cluster.
• Ensures keys remain secure and in plaintext only within HSMs.

Key Deletion

• Users can schedule deletion of customer master keys with a waiting period of 7 to 30 days, allowing assessment of impact before permanent deletion.
• Default waiting period is 30 days, and deletion can be canceled during this time.

Important APIs

• Encrypt and Decrypt for encrypting/decrypting data.
• Re-encrypt for changing the encryption key used.
• GenerateDataKey for creating a data encryption key.

KMS Envelope Encryption

• Integrates with AWS clients using envelope encryption for better data security.
• Data keys are encrypted using master keys through KMS to secure the data itself.

Limits and Recommendations

• Up to 1000 KMS keys can be created per account per region, including both enabled and disabled keys.
• It’s advisable to delete disabled keys no longer in use to manage limits efficiently.
• There are no restrictions on the number of data keys that can be generated from master keys.

AWS Key Management Store (KMS)

• AWS KMS is a managed service for data encryption and key management.
• Provides a reliable storage, management, and auditing solution for encryption across AWS services.
• Centrally manages and securely stores encryption keys, known as AWS KMS keys.

KMS Key Composition

• A KMS key includes metadata such as key ID, creation date, description, and key state.
• Contains key material used for encryption and decryption of data.
• Supports symmetric and asymmetric KMS keys.
• Key material remains encrypted within AWS KMS, ensuring security.

Types of KMS Keys

• Customer Managed KMS Keys:
  • Created and managed by the customer.
  • Allows full control over key policies, IAM policies, and grants.
  • Incur fees for creation and usage beyond the free tier.
• AWS Managed KMS Keys:
  • Created and managed by AWS services for the customer's account.
  • Limited control over rotation and key policies.
  • No monthly fee for these keys.
• AWS Owned KMS Keys:
  • Owned by AWS services for use across multiple accounts.
  • No visibility or management required by the customer.
  • No fees associated with these keys.

Data Encryption Keys (DEKs)

• Used for encrypting larger datasets and other data encryption keys.
• Generated, encrypted, and decrypted using AWS KMS keys.
• Managed outside of AWS KMS; KMS doesn't store or track these keys.

Key Management Capabilities

• Usage policies determine which users can perform encryption and decryption.
• KMS keys can be generated within KMS or imported from external infrastructure.
• Encrypted data must be handled within HSMs in certified environments.

KMS Integration and Compliance

• Works with various AWS services including Lambda, S3, EBS, EFS, DynamoDB, and SQS.
• Requests for master key usage are logged via AWS CloudTrail for auditing.
• Validated by compliance standards such as PCI DSS Level 1 and FIPS 140-2 Level 2.
• Specifically designed for encryption key management, distinct from Secrets Manager.

Key Deletion and Management

• Keys can be scheduled for deletion with a waiting period of 7 to 30 days, defaulting to 30 days.
• Deletion can be canceled during the waiting period to assess impact on applications.

APIs for KMS Operations

• Key APIs include:
  • Encrypt: Encrypt data.
  • Decrypt: Decrypt data.
  • Re-encrypt: Change encryption without intervention.
  • Enable-key-rotation: Automatically rotate keys.
  • GenerateDataKey: Create a data encryption key.

KMS Limits

• Maximum of 1000 KMS keys per account per region, including enabled and disabled keys.
• No limits on the number of data keys derivable from a master key.
• Identify and delete unused disabled keys to manage limits effectively.

Test your knowledge of AWS Key Management Store (KMS), a managed service for encrypting data, managing and storing keys, and controlling encryption across AWS services.