AWS Key Management Service (KMS)

AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Hardware Security Modules (HSMs) to protect the security of your keys. AWS Key Management Service is integrated with several other AWS services to help you protect the data you store with these services. AWS Key Management Service is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.

• Key Management Service → Create key
• Configure key → Symmetric
• Add labels → alias + description
• key administrative permissions → select user/role
  • Key Administrators → users/roles that manage access to the encryption key
• key usage permissions
  • Key Users → users/roles that use the key to encrypt/decrypt data

knowledge check

1. AWS KMS for S3 bucket encryption > S3 managed keys
   1. provides additional key management features + auditing
2. defining key administrative permissions for master key
   1. control who can manage the key’s properties + policies
3. configuring CloudTrail to store logs in S3 bucket
   1. maintains audit trail of AWS account activity
4. management events
   1. cloudtrail event type for aws kms key usage monitoring
5. access control for kms keys
   1. access is denied by default unless explicitly granted