Study Guides/AWS Cybersecurity Notes/Amazon KMS - Revision history

Mflavell at 00:49, 20 June 2026

2026-06-20T00:49:36Z

← Older revision		Revision as of 00:49, 20 June 2026
Line 267:		Line 267:

	:* Granular control is enabled through KMS.		:* Granular control is enabled through KMS.


			= Roles in KMS =


			*: Key admins - Full control over the keys

			*: Key users - have the ability to use keys, but limited control over key functiality.

			*: Key managers - These are a corssover between admins and users.

			*: IAM users and roles - IAM users and roles can be given access to CMKs.


			= Key polcies =


			Each key is governed by a single key policy.

			:: This provides a cental approach to access control.


			The key policy is used to determine ctyptographic operations.

2026-06-20T00:36:32Z

← Older revision		Revision as of 00:36, 20 June 2026
Line 219:		Line 219:

	The policy enfoces secure granular access control.		The policy enfoces secure granular access control.


			= Key Grants =


			Allows contol and management of cryptographic functions on keys.

			You define a AWS IAM user role or AWS account to provide access.

			::You then speficy what actions should be allowed by that principle.


			This allows find graned control over keys.


			= What about Envelope encryption =


			:* Data is encrypted.

			:* The key for the data is also encrypted by another key.


			The top level key is know as a master key.


			== How it works in KMS ==

			Customer mater key: This is a symmetric key managed by KMS,

			DEK: Used when data needs to be encrypted.

			::Enveloping the DEK: The DEK is encrypted with the master key.

			::Storing the DEK: The encrypted DEK - known as the envelope key is stored with the data.

			::Decrypting the enevelpe key: the DEK (envelope key) is passed to KMS from storage.

			::Decrypting data: The decrypted DEK (decrytped by KMS) is used to decrypt the data.


			This has seneral advantages:

			:* The master key never leaves KMS.

			:* The DEK is proected and seperate from the data.

			:* Granular control is enabled through KMS.

2026-06-19T02:19:00Z

Key Policies

← Older revision		Revision as of 02:19, 19 June 2026
Line 212:		Line 212:

	= Key Policies =		= Key Policies =


			These control acess to KMS kets.

			Each KMS key is associated with a policy that defines who can use the key.

			The policy enfoces secure granular access control.

2026-06-19T02:13:10Z

Kry Policies

2026-06-19T01:41:17Z

← Older revision		Revision as of 01:41, 19 June 2026
Line 200:		Line 200:

	::Import (external) key material under advanced options		::Import (external) key material under advanced options


			:* The key materlal must be in binary format.

			:* An experation date can be provided.

			:: If the expration date is reached or the material is deleted it is gone forever.

			:* If imported key material is used the key must be manually rotated.


			= Kry Policies =

2026-06-19T01:27:44Z

← Older revision		Revision as of 01:27, 19 June 2026
Line 174:		Line 174:

	:* Important part: DECs are symmetrical keys!		:* Important part: DECs are symmetrical keys!


			= Key Material =

			Key material is used to encryptd and decrypt.

			:* Customers cannot manage the key material in any way!

			:* The key material is inside the CMK.

			::* The CMK material is used to create the DMK

			:* AWS Manged CMK - automatically creates the material inside the CMK.

			:* For cusomter manaaged CMK - you create the CMK and import your own key material.


			== Importing key material ==

			This may be needed if you have keys in use outside of AWS and need to bring them in.

			This also could be for regulatary needs.

			To do this:

			::Import (external) key material under advanced options

2026-06-19T01:13:08Z

← Older revision		Revision as of 01:13, 19 June 2026
Line 139:		Line 139:

	* If policy states keys must be rotated on demand (after an incident) customer managed is best.		* If policy states keys must be rotated on demand (after an incident) customer managed is best.


			== Data Encryption Keys ==


			These are generated by KMS for encrypting data.

			They are used WITH customer-managed keys to protect infomation.

			They are short lived - only used for specific encryption operations.

			DEKs proide an extra layer of security:

			:: DEK - Encrypts the data

			::: CMK - Encrypts the DEK


			About DEKs:

			:* Managed and generated in KMS

			:* Used with CMK's

			:* They are randomly generated.

			:* Use envelope encryption Encrypted > DEC > CMK > Decrypted

			:* DEKs are fast and efficient.

			:* Can be used with vrious AWS services

			:* KMS manages the DEC lifecycle.

			:* Important part: DECs are symmetrical keys!

2026-06-19T00:45:22Z

Selecting a key type

← Older revision		Revision as of 00:45, 19 June 2026
Line 127:		Line 127:

	KMS provides the rools and security measures - but security is on the customer.		KMS provides the rools and security measures - but security is on the customer.



	== Selecting a key type ==		== Selecting a key type ==

	* Policy will dictate the key type.		* Policy will dictate the key type.


	* AWS managed keys may be ok if complete control is not needed.		* AWS managed keys may be ok if complete control is not needed.

	:* AWS managed keys have no charge.		:* AWS managed keys have no charge.


	* If policy states keys must be rotated on demand (after an incident) customer managed is best.		* If policy states keys must be rotated on demand (after an incident) customer managed is best.

2026-06-19T00:44:15Z

Customer Managed Keys

← Older revision		Revision as of 00:44, 19 June 2026
Line 103:		Line 103:


	* Provides the customer total control over the key.		Provides the customer total control over the key.

			:: Customer has complete control over the lifecycle of a key.

			:: This provides greater flexibility and customization.


Line 111:		Line 114:
	* Rotation schedules.		* Rotation schedules.

	* Permissions.		* Permissions based on requirements.


			These keys are not tied to any feature or service.

			:* They can be used inside or outside of AWS.

			:* Much more contol over key use and permissions.

	* These keys are not tied to any feature or service.

			It is the '''customer responsibility''' to protect customer managed keys.

	* It is the ~~'''customer responsibility''' to protect~~ customer ~~managed keys~~.		KMS provides the rools and security measures - but security is on the customer.

	== Selecting a key type ==		== Selecting a key type ==

2026-06-19T00:38:34Z

Customer Managed Keys

← Older revision		Revision as of 00:38, 19 June 2026
Line 96:		Line 96:

	* AWS KMS Default CMK - used for default encryption in EBS, RDS and Redshift.		* AWS KMS Default CMK - used for default encryption in EBS, RDS and Redshift.




	== Customer Managed Keys ==		== Customer Managed Keys ==
Line 115:		Line 118:

	* It is the '''customer responsibility''' to protect customer managed keys.		* It is the '''customer responsibility''' to protect customer managed keys.


	== Selecting a key type ==		== Selecting a key type ==