How CMKs work in KMS, what rotation really costs, and a decision table for choosing between AWS-managed and customer-managed keys.
Encryption is vital to protecting the integrity and confidentiality of sensitive data, as is understanding how it is applied in one’s products and services.
Amazon Web Services (AWS) primarily supports encrypted key management through its Key Management Service (KMS). The AWS KMS key, formerly known as a Customer Master Key(CMK), is the foundation of this service.
Within AWS, a CMK is a key that manages the encryption and decryption of customer data.
Capable of managing up to 4 KB at a time, CMKs provide extensive control over how and where data is encrypted. Larger datasets require envelope encryption, in which the CMK generates a data key.
CMKs are customizable and highly secure, safeguarded through FIPS 140-3 validated hardware security modules (HSMs). Their region-specificity also supports regulatory compliance and helps minimize vulnerabilities.
Although Amazon has rebranded CMKs to AWS KMS keys, their core functionality remains unchanged.
The AWS Key Management Service (KMS) is a global service that allows users to create, manage, and employ encryption keys across over 60 AWS services.
It centralizes key management for all connected services into a single platform and supports symmetric and asymmetric encryption. The service also provides additional features such as automatic key rotation and auditing.
CMKs are categorized in two ways. First, by the type of encryption they support:
CMKs may also be classified based on who owns and manages them:
If your organization leverages AWS, encryption keys are an essential component of security, with applications that include, but are not limited to:
AWS keys can encrypt data stored in S3 buckets, EBS volumes attached to EC2 instances, and DynamoDB tables.
Several AWS services are specifically designed to encrypt in-transit data, including AWS Certificate Manager and AWS CloudFront. Both services integrate with other AWS offerings, using keys to protect data and indirectly manage certificates.
Because AWS KMS keys provide granular control over encryption, they allow customers to ensure their data is encrypted in a specific manner. This is invaluable for complying with regulations, such as HIPAA, the GDPR, and PCI-DSS.
By leveraging AWS SDKs, developers can integrate keys directly into their code, allowing them to control how their application encrypts and accesses data.
As mentioned above, asymmetric keys can validate the integrity and authenticity of data, especially digital signatures.
Tamnoon reads the findings your scanner already raised, closes what Tamnoon can prove safe through your own controls, and declines the rest in writing with the evidence why.
