AWS — KMS

What is KMS?

Managed service for creating and controlling encryption keys.

Create key

aws kms create-key \
  --description "My encryption key" \
  --tags TagKey=Name,TagValue=my-key

Encrypt data

aws kms encrypt \
  --key-id alias/my-key \
  --plaintext "Hello World" \
  --output text \
  --query CiphertextBlob | base64 --decode > encrypted.bin

Decrypt data

aws kms decrypt \
  --ciphertext-blob fileb://encrypted.bin \
  --output text \
  --query Plaintext | base64 --decode

Generate data key

import boto3

kms = boto3.client('kms')

response = kms.generate_data_key(
    KeyId='alias/my-key',
    KeyPairSpec='AES_256'
)

# Use response['Plaintext'] for encryption
# Store response['CiphertextBlob'] for decryption

Key policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789:root"},
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}

Best practices

1. Use least privilege
2. Enable key rotation
3. Use aliases for management
4. Monitor with CloudTrail

Mini Practice

1. Create a KMS key
2. Encrypt and decrypt data
3. Generate data keys
4. Set up key policies

Up Next

Continue with Certificate Manager - SSL/TLS certificates.