# KMS

[Document](https://docs.aws.amazon.com/kms/) | [Multi-region key](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html) |

## Overview

* KMS uses Hardware Security Modules (HSM) to protect and validate your AWS KMS keys.
* Need to set IAM Policy & Key Policy to allow a user or role to access a KMS key (encrypt or decrypt data using the key)

<figure><img src="https://arkalim.notion.site/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Ff102c610-7023-4662-bc0a-64979fd1a4eb%2FUntitled.png?table=block&#x26;id=f1e56bdc-de01-485d-a10f-5ee527ec64fc&#x26;spaceId=bf3df57d-a354-4a62-aedc-c0c5d8650229&#x26;width=2000&#x26;userId=&#x26;cache=v2" alt=""><figcaption><p>IAM policy</p></figcaption></figure>

* Does not support versioning of keys (cannot get back the old key).

### Types of key

* AWS-owned
* ***Symmetric***: a <mark style="background-color:yellow;">256-bit key</mark> that is used for encryption and decryption.
  * AWS managed key. These keys have alias start with `aws/***`. e.g: `aws/ebs`
  * Customer managed key
* ***Asymmetric***:&#x20;
  * Public (Encrypt) and Private Key (Decrypt) pair. an RSA key pair that is used for encryption and decryption or signing and verification (but not both), or an elliptic curve (ECC) key pair that is used for signing and verification.
  * manual rotation.

<figure><img src="https://2259236002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fuh9xZDZ53qGqmMCM44PU%2Fuploads%2Fmc87qjC1we87hr98g3zq%2Fimage.png?alt=media&#x26;token=a474bd50-d197-4638-8e39-7fe08f40c2c7" alt=""><figcaption><p>3 types of KMS key</p></figcaption></figure>

### Key usage

* Encrypt and decrypt
* Generate and verify MAC

## Features

### Multi-regions key

* *<mark style="color:red;">Copies of the same KMS key</mark>* in different AWS Regions.
* You need to create the alias of the key in the region you want to use key. The alias can be different with the primary key.

### KMS Policy

* Allow which users, services can use the keys.
* Specify which services can decrypt key data. Remember to add kms decrypt policy to the key itselft.

### Key rotation

Enable to rotate the key *<mark style="color:red;">every year</mark>*.

{% hint style="danger" %}
Automatic key rotation *<mark style="color:red;">is not supported</mark>* for imported keys, asymmetric keys, or keys generated in a CloudHSM cluster using the AWS KMS custom key store feature.&#x20;

If you choose to import keys to AWS KMS or asymmetric keys or use a custom key store, you can manually rotate them by creating a new KMS key and mapping an existing key alias from the old KMS key to the new KMS key.
{% endhint %}

## KMS API

* `Encrypt`: can only encrypt data under 4 KB
* `Decrypt`: can ***only be used*** on data that have been encrypted with a KMS key.
* `GenerateDataKey`: creates data key using a KMS key and returns two versions of it: <mark style="color:red;">a plaintext</mark> and <mark style="color:red;">a ciphertext data key</mark>.

```
aws kms generate-data-key --key-id alias/MyKeyAlias --key-spec AES_256
```

* `GenerateDataKeyWithoutPlaintext`: creates data key using a KMS key and returns ***only*** the encrypted version of it.

## Pricing

Pay for the number of API calls made to KMS. Charge per / 10000 requests.

***

## Trivia

* if you want a more secure solution than KMS key, use **CloudHSM** key.
  * KMS and CloudHSM are both FIPS compliant.
  * KMS is level 2, CloudHSM is level 3.
* You CANNOT *immediately* delete a KMS key. You need to <mark style="color:red;">schedule</mark> a range from 7 \~ 30 days to delete it.
* If you update a key's policy, remember to re-create resources that use that key. If not, the resource is still using the key with old policy.
* You CANNOT rotate AWS Managed key, but CAN rotate Customer managed key.
* Encrypt up to 4KB of data per API call (if data > 4 KB, use <mark style="color:red;background-color:yellow;">envelope encryption</mark>)

## Concepts

* ***Envelope encryption***: is the **practice of encrypting plaintext data with a data key and then encrypting the data key under another key.** You must store the encrypted form of the data key so that you can use the data key to decrypt the encrypted data in the database.

<figure><img src="https://2259236002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fuh9xZDZ53qGqmMCM44PU%2Fuploads%2FaVAD1pGVr9Ge4gOdzZ1S%2Fimage.png?alt=media&#x26;token=8881d30d-ece8-45c2-9984-cc9297f1dacb" alt="" width="563"><figcaption><p>Envelope encryption</p></figcaption></figure>
