Amazon KMS - Revision history

Mflavell at 22:53, 2 June 2025

2025-06-02T22:53:14Z

← Older revision		Revision as of 22:53, 2 June 2025
Line 202:		Line 202:
	Key Managers		Key Managers

	* Can create and ~~manange~~ CMKs		* Can create and manage CMKs
	* Can define polices and ~~rotaton~~ schedules.		* Can define polices and rotation schedules.
	* Role is combined admin / user.		* Role is combined admin / user.

Line 211:		Line 211:
	* Assigned permissions to keys.		* Assigned permissions to keys.
	* Granular access is provided.		* Granular access is provided.
	:* Its important to implement ~~seperation~~ of duties here.		:* Its important to implement separation of duties here.


			= Cross Region Key Management =

			* Cross region replication must be enabled.

			* Select a primary region.

			* Use a consistent key policy.

			* Data transfer and latency will be factors.

			* Understand compliance and data residency laws.

2025-06-02T22:46:02Z

Key Policies

← Older revision		Revision as of 22:46, 2 June 2025
Line 164:		Line 164:

	* The primary function of a key policy is control of who can perform operations with the key.		* The primary function of a key policy is control of who can perform operations with the key.

			* Without a key policy their is no control over the CMKs

	== Grants ==		== Grants ==

2025-06-02T22:44:12Z

Key Policies

← Older revision		Revision as of 22:44, 2 June 2025
Line 160:		Line 160:
	:* Also defines who can encrypt, decrypt and rotate.		:* Also defines who can encrypt, decrypt and rotate.


			* Each key can only have a single key policy associated with it.

			* The primary function of a key policy is control of who can perform operations with the key.

	== Grants ==		== Grants ==
Line 168:		Line 172:

	* Evelope encryption is used. Data is encrypted with a key, the key is encrypted with another key.		* Evelope encryption is used. Data is encrypted with a key, the key is encrypted with another key.


	= Envelope encrpytion in KMS =		= Envelope encrpytion in KMS =

2025-06-02T01:20:28Z

← Older revision		Revision as of 01:20, 2 June 2025
Line 184:		Line 184:

	*: The DEK is stored seperate from the data.		*: The DEK is stored seperate from the data.


			= KMS Roles =

			Key Administrators.

			* Complete control over their keys.
			* Can define policies
			* Configure key rotation schedules.


			Key Managers

			* Can create and manange CMKs
			* Can define polices and rotaton schedules.
			* Role is combined admin / user.


			IAM Users and Roles

			* Assigned permissions to keys.
			* Granular access is provided.
			:* Its important to implement seperation of duties here.

2025-06-02T00:42:13Z

Key Policies

← Older revision		Revision as of 00:42, 2 June 2025
Line 148:		Line 148:
	= Key Policies =		= Key Policies =

	These contol access to the KMS keys		These contol access to the KMS keys.

			* Each KMS key is associated with a policy.

			:* Policy defines who can access they key.

			:* Policy helps enforce secure access to keys.

			:* Defines what users, roles and accounts can access a key.

			:* Also defines who can encrypt, decrypt and rotate.


			== Grants ==

			* These define who can perform functions.

			* Provide fine grained controls.

			* Evelope encryption is used. Data is encrypted with a key, the key is encrypted with another key.


			= Envelope encrpytion in KMS =

			* The master key - Customer Master Key protects the data.

			* A DEK is generated - the DEK is random.

			* The DEK encrypts the data.

			:* The DEK is encrypted with the master key (CMK).


			* The DEK is read when the data needs to be decrypted.

			*: The DEK is stored seperate from the data.

2025-06-02T00:20:52Z

← Older revision		Revision as of 00:20, 2 June 2025
Line 144:		Line 144:

	* This key material must be encrypted with a symmetric encryption key.		* This key material must be encrypted with a symmetric encryption key.


			= Key Policies =

			These contol access to the KMS keys

2025-05-30T23:08:31Z

← Older revision		Revision as of 23:08, 30 May 2025
Line 129:		Line 129:
	* KMS manages the DEK lifecycle		* KMS manages the DEK lifecycle
	* DEK's are symmetric keys (they they are fast)		* DEK's are symmetric keys (they they are fast)

			= Key Material =

			AWS creates the material for the KMS key. [https://repost.aws/questions/QUONBkdQZ5RCapsT9p2K0x7w/what-is-kms-key-material]

			* The customer can delete the key but not the key material.

			* Key material cannot be exported, viewed or managed - it is secret!


			KMS automatically creates the key material.

			When you create your own CMK you can import your own key material.

			* This key material must be encrypted with a symmetric encryption key.

2025-05-30T22:51:39Z

Data Encryption Keys

← Older revision		Revision as of 22:51, 30 May 2025
Line 113:		Line 113:
	* A DEK is short-lived and used for a specific operation.		* A DEK is short-lived and used for a specific operation.

			* Provides an extra layer of security.
			: DEK encrypts data
			: CMK encrypts the DEK

	~~:* Proved an extra layer of security.~~
	~~:: DEK encrypts data~~
	~~:: CMK encrypts the DEK~~

			== DEK facts ==

	* A DEK is generated by KMS.		* A DEK is generated by KMS.

2025-05-30T22:50:55Z

Data Encryption Keys

← Older revision		Revision as of 22:50, 30 May 2025
Line 123:		Line 123:
	* Envelope encryption.		* Envelope encryption.
	:* Data encrypted with DEK / DEK encrypted with CMK		:* Data encrypted with DEK / DEK encrypted with CMK

	* A DEK is fast and efficient.		* A DEK is fast and efficient.
	* Can be used with various AWS services.		* Can be used with various AWS services.
	* KMS manages the DEK lifecycle		* KMS manages the DEK lifecycle
	* DEK's are symmetric keys (they they are fast)		* DEK's are symmetric keys (they they are fast)

2025-05-30T22:50:39Z

Data Encryption Keys

← Older revision		Revision as of 22:50, 30 May 2025
Line 108:		Line 108:

	* These are generated by KMS for encrypting data.		* These are generated by KMS for encrypting data.

			* The are used in conjunction with customer-managed keys.

			* A DEK is short-lived and used for a specific operation.


			:* Proved an extra layer of security.
			:: DEK encrypts data
			:: CMK encrypts the DEK


			* A DEK is generated by KMS.
			* A DEK is random.
			* Envelope encryption.
			:* Data encrypted with DEK / DEK encrypted with CMK
			* A DEK is fast and efficient.
			* Can be used with various AWS services.
			* KMS manages the DEK lifecycle
			* DEK's are symmetric keys (they they are fast)