AWS KMS

AWS Key Management Service (KMS) creates and controls the encryption keys that protect your data in AWS. Encryption scrambles information so that only someone holding the right key can read it. KMS stores those keys safely and records every use.

Picture a bank with a vault of safe deposit boxes. The bank never hands out the master key. Customers ask a clerk to open a box, and the clerk checks their identity first. KMS acts as that clerk. Your applications ask KMS to lock or unlock data, and the key itself never leaves the vault.

Why Encryption Matters

  • Stolen files stay unreadable without the key.
  • Many industries require encryption for customer and payment data.
  • Encryption adds a second layer of protection beyond passwords and permissions.

Encryption at Rest and in Transit

Data at rest sits in storage, such as an S3 bucket or an EBS volume. Data in transit travels across a network. KMS mainly protects data at rest. HTTPS and TLS protect data in transit.

Types of KMS Keys

  • AWS owned keys: AWS manages them completely, and they do not appear in your account.
  • AWS managed keys: AWS creates them in your account for a service such as S3 or RDS. You view them but cannot change their policies.
  • Customer managed keys: you create them and control access, rotation, and deletion.

Which One to Pick

Choose AWS managed keys for quick, low-effort protection. Choose customer managed keys when you need custom permissions, audit control, or separate keys for different teams.

Envelope Encryption Explained

KMS can encrypt only small pieces of data directly, up to 4 KB. Large files use envelope encryption. KMS creates a data key. The data key encrypts the file. KMS then encrypts the data key itself, and the encrypted data key travels with the file.

Think of locking a diary with a small padlock, then placing the padlock key inside a vault. Anyone who steals the diary finds a locked padlock and no key.

STEP A: Encrypt
  Your file --------+
                    v
  KMS creates --> Data Key --> Encrypted file
                    |
              KMS encrypts the Data Key
                    |
                    v
  Stored together: Encrypted file + Encrypted data key

STEP B: Decrypt
  Send encrypted data key to KMS
        |
        v
  KMS returns plain data key (if permission allows)
        |
        v
  Data key unlocks the file

Key Policies and Permissions

Every KMS key has a key policy. The policy lists who may use the key and who may manage it. IAM policies add further permissions on top of the key policy. Separate the people who manage keys from the people who use them to reduce risk.

Common Permissions

  • kms:Encrypt allows locking data.
  • kms:Decrypt allows unlocking data.
  • kms:GenerateDataKey allows envelope encryption.
  • kms:ScheduleKeyDeletion allows removing a key, so grant it sparingly.

Services That Use KMS

  • S3 encrypts objects with server-side encryption.
  • EBS encrypts volumes and snapshots.
  • RDS encrypts databases and backups.
  • Secrets Manager protects stored passwords.
  • Lambda protects environment variables.
        +------------+
        |  KMS Key   |
        +-----+------+
              |
   +----------+----------+----------+
   |          |          |          |
  S3        EBS        RDS      Secrets
 bucket    volume    database   Manager

Key Rotation

Rotation replaces the key material on a schedule so that an old key exposes less data over time. Enable automatic rotation for customer managed keys. AWS keeps older material available, so previously encrypted data still decrypts.

Auditing Key Use

CloudTrail records each KMS request, including who called it and when. Review these logs to spot unusual activity, such as decrypt calls at odd hours from unknown identities.

Deleting Keys Safely

Deleting a key makes all data encrypted with it permanently unreadable. KMS enforces a waiting period of 7 to 30 days before deletion completes. Use the waiting period to confirm that nothing still depends on the key. Disable the key first and watch for errors.

Practice Steps

  1. Open the KMS console and create a customer managed symmetric key.
  2. Give the key a clear alias such as demo-practice-key.
  3. Create an S3 bucket and set default encryption to your key.
  4. Upload a file and check its encryption details.
  5. Schedule the key for deletion when practice ends.

Best Practices

  • Use separate keys for separate applications or environments.
  • Apply least-privilege permissions.
  • Enable rotation and CloudTrail logging.
  • Name keys with aliases that describe their purpose.
  • Never place plain encryption keys in code or documents.

KMS lets teams encrypt data across AWS with consistent control and a clear audit trail.

Previous lesson
Back to course
Next lesson