AWS Key Management Service (KMS)

Data encryption is a fundamental pillar of cloud security. AWS Key Management Service (KMS) provides a centralised, managed service for creating, managing, and controlling encryption keys used to protect your data across AWS services.

---

What is AWS KMS?

AWS KMS is a fully managed service that makes it easy to create and manage cryptographic keys used to encrypt data. KMS integrates with dozens of AWS services — including S3, EBS, RDS, Lambda, and Secrets Manager — so you can encrypt your data with a few clicks or lines of code.

KMS handles the complexity of key management: key creation, rotation, access control, and auditing — all in a secure, FIPS 140-2 validated environment.

---

Key Concepts

Customer Master Keys (CMKs) / KMS Keys

A KMS key (formerly called a Customer Master Key or CMK) is the primary resource in KMS. It is a logical representation of a cryptographic key. KMS keys never leave the KMS service unencrypted — you interact with them through API calls.

There are three types of KMS keys:

Type	Created By	Managed By	Use Case
AWS managed keys	AWS	AWS	Default encryption for AWS services (e.g., aws/s3, aws/ebs)
Customer managed keys	You	You	Full control over key policy, rotation, and lifecycle
AWS owned keys	AWS	AWS	Used internally by AWS services — you do not see or manage them

Data Keys

KMS also generates data keys — plaintext encryption keys used to encrypt your actual data. This is called envelope encryption:

1. You call KMS to generate a data key.
2. KMS returns both a plaintext data key and an encrypted copy of the data key.
3. You use the plaintext data key to encrypt your data.
4. You store the encrypted data key alongside the encrypted data.
5. You discard the plaintext data key from memory.

To decrypt, you send the encrypted data key back to KMS, which returns the plaintext data key. You then use it to decrypt your data.

This approach means KMS never needs to handle your actual data — it only manages the keys.

---

Envelope Encryption in Detail

Envelope encryption is the standard pattern for encrypting data with KMS. Here is the flow:

Encryption

┌─────────────┐     GenerateDataKey      ┌─────────┐
│  Your App   │ ─────────────────────────→│   KMS   │
│             │ ←─────────────────────────│         │
│             │   Plaintext Key +         └─────────┘
│             │   Encrypted Key
│             │
│  Encrypt data with plaintext key
│  Store encrypted data + encrypted key
│  Discard plaintext key
└─────────────┘

Decryption

┌─────────────┐     Decrypt(encrypted key) ┌─────────┐
│  Your App   │ ──────────────────────────→│   KMS   │
│             │ ←──────────────────────────│         │
│             │   Plaintext Key            └─────────┘
│             │
│  Decrypt data with plaintext key
│  Discard plaintext key
└─────────────┘

---

Key Policies

Every KMS key has a key policy — a resource-based policy that controls who can use and manage the key. Without a key policy, nobody can use the key, not even the root user (unlike most AWS resources where the root user has implicit access).

Default Key Policy