Key Management Service (KMS)

• KMS is a managed service that makes it easy for you to create and control customer master keys (CMKs), the encryption keys used to encrypt your data.

• KMS CMKs are protected by hardware security modules (HSMs) that are validated by the FIPS 140-2 Cryptographic Module Validation Program except in the China (Beijing) and China (Ningxia) Regions.

• KMS is integrated with most other AWS services that encrypt your data and it is also integrated with CloudTrail to log use of your CMKs for auditing, regulatory, and compliance needs.

• KMS CMKs are 256-bit AES symmetric keys that are not exportable.

• Each CMK that you create in KMS costs $1/month until you delete it.

• KMS CMK cannot encrypt more than 4 KB of data.

Creating CMKs

1. Create KMS Key.

2. Create Key Administrators.

3. Create Usage Permission.

4. Verify the Key Policy.

5. KMS key is now created and ready to use.

Envelope encryption

• When you encrypt your data, your data is protected, but you have to protect your encryption key and one strategy is to encrypt the key.

• Envelope encryption is the practice of encrypting plaintext data with a data key, and then encrypting the data key under another key.

• You can even encrypt the data encryption key under another encryption key, and encrypt that encryption key under another encryption key. The top-level plaintext key encryption key is known as the master key.

• KMS helps you to protect your master keys by storing and managing them securely.

• Master keys stored in KMS (CMKs) never leave the KMS FIPS validated hardware security modules unencrypted.