AWS KMS mindmap

AWS Key Management Service

Create and control cryptographic keys used to protect data

• Key ownership
  • Customer managed keys: You create them and control policy, rotation and deletion
  • AWS managed keys: Created by a service for you (aws/service-name); you cannot change their policy
  • AWS owned keys: Owned and used by AWS across many accounts; not visible in your account
• Key types
  • Symmetric (AES-256): The default; the key never leaves AWS KMS unencrypted
  • Asymmetric (RSA, ECC): Encryption or signing; the public key can be downloaded
  • HMAC: Generate and verify message authentication codes
• Access control
  • Key policies: Every key has exactly one; the primary access control
  • IAM policies: Work only when the key policy allows the account to use IAM
  • Grants: Temporary, scoped permissions, often used by AWS services
  • Condition keys: For example kms:ViaService and kms:EncryptionContext
• Envelope encryption
  • Data keys: GenerateDataKey returns a plaintext and an encrypted copy
  • 4 KB limit: Direct Encrypt calls take at most 4 KB; larger data uses data keys
  • Encryption context: Additional authenticated data, logged in CloudTrail
• Rotation
  • Automatic rotation: Optional for customer managed symmetric keys, every 90 to 2,560 days
  • AWS managed keys: Rotate every year
  • On-demand rotation: Rotate a key immediately
  • Manual rotation: Create a new key and move the alias
• Key stores
  • Default key store: HSMs validated under FIPS 140-3 Security Level 3
  • CloudHSM key store: Keys in your own CloudHSM cluster
  • External key store: Keys in an HSM outside AWS
• Lifecycle
  • Aliases: Friendly names you can repoint to another key
  • Multi-Region keys: Related keys with the same key material in several Regions
  • Deletion: Scheduled with a waiting period of 7 to 30 days; disable first
  • Import key material: Bring your own key material
• Monitoring
  • AWS CloudTrail: Every use of a key is logged
  • Amazon CloudWatch: Metrics and alarms, such as on scheduled deletion