AWS Key Management Service - KMS Fundamentals

Welcome to Key Management Service Fundamentals course.  In this lesson, we'll outline the main topics of the course, tools used in the demonstrations and resources available to you. 

In this lecture, we'll cover the basic concept of cryptography and the role of a master key.  We'll look at what is Advanced Encryption Standard and why it's important that KMS uses this algorithm.  There are 2 main types of keys in KMS which are symmetric and asymmetric keys.  We'll cover what is the difference and when to use each type of keys using an illustration.  We'll formally introduce Customer Master Key which is the primary resource in AWS's Key Management Service.

• Cryptography Basics

• Advanced Encryption Standard (AES-256)

• Symmetric Key

• Asymmetric Key

• Customer Master Key

AWS Key Management Service can do a lot of things but it's important to understand what it is not.  In this lecture, we'll cover when to use KMS and when not to use KMS. 

In this lecture, we’ll look at different ownership models available for customer master keys in the Key Management Service. When you use Key Management Service, it's important to understand who has ownership of it. Different ownership models controls who can create, change and delete the keys. We'll cover what are your responsibilities vs. AWS responsibilities in each model.

• Who owns master key

• Customer Managed

• AWS Managed

• Custom Key Store

• Hardware Security Modules

In this lecture, we’ll cover AWS accounts and regions and what it means for customer master keys that are managed by KMS.  We'll look at the scope of the customer master key in context of an AWS account and region and how this impacts your solution.    

• Customer Master Key scope

• AWS Region

• AWS Account

• AWS Services Integration

We'll create a new symmetric customer master key using AWS console.  Then, we'll use a Python application with Boto3 SDK to encrypt and decrypt data using our new symmetric key. 

• Step by step how to create symmetric key using AWS console wizard

• Sample Python application to encrypt and decrypt text

• Set up credential to authenticate Python application to AWS account

• Run application to encrypt and decrypt text using symmetric key.

Key Management Service has feature to upload your own key material to create a symmetric key.  In this lecture, we'll cover what is a key material, why you may consider this option and what is your responsibility if you choose this option.  We'll create a new customer master key by importing a new key material and demonstrate step by step how to upload your own key material. 

• What is a key material

• How to create a key material

• How to upload a key material to create a symmetric key

• Key material relationship to Customer Master Key

• Re-importing a key material

• Deleting key material

• Backup and restore consideration

Understanding who can do what in KMS is essential to building a secure solution.  In this lecture, we look at 3 ways you can manage access and common use cases.

• Key Policy

• IAM Policy

• Grant

• Key Administrator use case

• Key user use case

This lesson look at the basic structure of a key policy and the statements inside.  Specifically, we look at a statement that governs what the root user can do and its function to apply IAM policy to the customer master key.  We'll use AWS Command Line Interface (CLI) to demonstrate the effects of this first very important policy statement. 

• Root User authorization

• Enable IAM Policy in a key policy

In this lecture, we'll look at how to configure key policy and IAM policy to access for key administrators and users.  We'll create key policy for administrator and user use case.  Then we'll create similar IAM policy to demonstrate how these policies can be used together to control access to the customer master key.  Finally, we'll discuss pro's and con's of using key policy and IAM policy.  We'll use AWS CLI to demonstrate the effects of the policy on access for both user and administrator of the key.   

• KMS actions for administrators and users

• Using key policy to set permissions

• Using IAM policy to set permissions

• Pro's and con's of using key policy and IAM policy

Grant is another way to configure who can do what in addition to key policy and IAM policy.  Grants allow you to configure access programmatically without modifying the policy statements.  We'll use Python application to create grant and AWS CLI to demonstrate how to use the grant.  We'll also see demonstration of how configure grants to principals across AWS account

• What is a grant

• How to create grant

• When to use grant

• Using grants for principals across accounts 

let's test your knowledge on KMS access management.

In this lesson, we’ll look at what it means to encrypt and decrypt data stored in the Simple Storage Service or S3. Encrypting data at rest is a common use case because S3 is a very popular service where you can store virtually unlimited objects organized into buckets.

In this lecture, we'll look at 5 different ways to encrypt data at rest in S3.  We'll upload items to an S3 bucket configured with different keys and see how S3 encrypts data at rest on the server side.   

1. S3 owned key (SSE-S3)

2. Customer Managed Key (SSE-KMS)

3. AWS Managed Key (SSE-KMS)

4. Customer Provided Key (SSE-C)

5. Client Side Encryption

In this lecture we'll look at how to use S3 bucket policy to control server side encryption method and key when putting objects into S3.  The demonstration uses Python application using boto3 SDK.  We'll configure a bucket policy to demonstrate the effect on the put operation and resulting encrypted.  We'll also look at some tips on what not to do on the bucket policy to enforce that all objects are encrypted using the same customer master key.   

In this lecture, we’ll discuss what is envelope encryption and data keys. It turns out that when S3 encrypt objects on the server side, it doesn’t actually use the master key directly. It uses what’s called a data key and a technique called envelope encryption.

• What is envelop encryption

• Data key

• Master key relationship to data key

• Envelope encryption advantage

In this lesson, we’ll learn how server side encryption with KMS works when you turn on versioning and replication in S3.  We'll demonstrate how S3 encrypts each version of the objects using specified server side encryption method using envelop encryption technique.  Another common use case is a cross region replication for S3 bucket with server side encryption.  The demonstration will set up a S3 cross region replication with server side encryption to see what customer master keys are used.  We'll also look at the role of default encryption and key policy when replicating object across regions.

Elastic Block Storage (EBS) is commonly used as primary storage for EC2 or RDS.  One of the common use case is to encrypt the data stored in EBS using Customer Master Key.  In this lecture, we'll discuss what is EBS and explain how it uses data key in memory to perform cryptographic operations.  We'll also discuss how EBS achieves the performance using this technique rather than envelop encryption used in S3.    

One of the features of EBS is to take a snapshot and detach it from an EC2 instance.  Then you can restore the snapshot of the EBS to another EC2 instance.  In this lecture, we'll discuss how to do this when the data on the EBS encrypted using a customer master key.

• Launch new EC2

• Restore EBS to another EC2

• Consequence of deleting customer master key

• How do you attach EBS to an EC2

• Configure Customer Master Key to encrypt EBS

• How encryption works in an extremely high read/write scenario using EBS

Deleting a CMK is a very permanent business. It’s so serious that AWS forces you to wait at least 7 days before it is actually deleted.  In this lecture, we'll discuss what actually happens when you delete a customer master key and its consequences.  We'll also cover special consideration if you decide to import your own key material.

It is good practice to rotate your keys tp avoid extensive reuse.  In this lecture, we'll discuss how to rotate your key and what that means to the data that was encrypted using the old key. 

• Automatic rotation

• Manual rotation

• What happens to the data previously encrypted with old key 

• Limitations

Alias is another resource type in the Key Management Service. In this lecture, we'll discuss what is an alias and it's purpose.  We'll demonstrate how to create an alias and associate it with a customer master key.  Then we'll see how to use alias to reference customer master key.

In this lesson, we’ll discuss the limits and cost associated with Key Management Service. Like all services in AWS, there are limits and it’s important to understand them when you go to build a real world solution.  Broadly speaking, there are 2 types of limits in KMS which are resource limit and request limit.  We'll cover each types, how to adjust them and regional considerations.  We'll also review the types of keys because the limits vary by types of keys. 

The pricing model is another important topic we'll cover.  There are cost associated with resources itself such as customer master key per month.  Then there are usage cost for number of requests to the customer master key.  We'll look at 2 examples: S3 bucket and EBS encryption.  Both services accomplish encryption at rest using KMS but cost can be very different. 

Congratulations. You’ve completed the Amazon Web Service’s Key Management Service Fundamentals course.  I want to thank you for taking this course and would appreciate your feedback. Your feedback will help me improve on my journey in learning and producing future courses. Thanks again and best wishes. Keep learning and keep building.