AWS Key Management Service ( KMS )

AWS Key Management Service is used to manage encryption keys and secure sensitive data within AWS environments. We can use these keys for the data center ( Onpreme) encryption as well. The KMS keys that we created in AWS are secured and protected by the FIPS 140–3 Security Level 3 validated hardware security modules (HSM). In DataCenter, we can use HSM hardware devices as well, but that is costly and involves management overhead.

Why use AWS KMS?

For data encryption

Whenever we encrypt data, we need to protect our encryption key. If we want to encrypt a key, we need to protect its encryption key. Eventually, we will protect the highest-level encryption key (known as a root key) in the hierarchy that protects our data. In that case, it is not easy for us to keep this key in a secret way, we can not keep it in an env variable or in any DB, if servers are hacked, keys will be compromised. That’s where AWS KMS comes in.

AWS KMS protects our root keys. KMS keys are created, managed, used, and deleted entirely within AWS KMS. They never leave the service unencrypted. To use or manage KMS keys, we call KMS from our application code.

Use Case

Data Key: The data key will be used to encrypt the data. These are symmetric keys.

Data: Data which should be stored in a secure way ( e.g. RSA private keys in an application, Key pairs are asymmetric data keys consisting of a mathematically-related public key and private key).

CMK: Master key/root key to encrypt the data key. Root keys stored in AWS KMS are known as AWS KMS keys.

Envelope Encryption for Larger Data

Because KMS limits direct encryption to 4,096 bytes, larger files are handled using Envelope Encryption. In the above case, we are using envelope encryption to store Master key in the KMS.

Create Keys

Master Key Creation

Master key refers to a logical key that might refer to one or more hardware security module (HSM) backing keys. This is a KMS Customer Managed key generated from the AWS Console.

Data Key Creation

An encrypted data key corresponding to this is created using the AWS api and this is stored in the database.

Public/Private Keys(Data) Creation

With asymmetric encryption, both the public and private keys are generated randomly. Together, they are used to encrypt and decrypt messages. If you encode a message using a person’s public key, they can only decode it using their matching private key.

In our case client/app/panel encrypts the passcode using public key and same in decrypted using the corresponding private key at Application end.

Generation of RSA Keys: Generate a private-public key combination for all the clients:

1. To generate a private key, open a terminal and enter below command- openssl genrsa -out <privateKeyFileName>.pem 2048 eg, openssl genrsa -out applicationname_key_2048.pem 2048
2. To generate a public key for the above-generated private key, enter below command- openssl rsa -in <privateKeyFileName>.pem -outform PEM -pubout -out <publicKeyFileName>.pem eg. openssl rsa -in applicationname_key_2048.pem -outform PEM -pubout -out applicationname_2048.pem

Type of Keys.

AWS Managed Keys

Is managed by AWS for those customers who want to manage the encryption, but don’t want the overhead to manage the Keys, and don’t want to pay for the keys

AWS managed keys are a legacy key type that is no longer being created for new AWS services as of 2021. Instead, new (and legacy) AWS services are using what’s known as an AWS owned key to encrypt customer data by default.

Customer Managed Keys ( CMK )

The KMS keys that we created for our use in cryptographic use cases are known as Customer managed keys. These keys can also be used for the AWS services, as well which use the KMS. Like S3, we can use custom managed keys. These keys are recommended for those who want full control and lifecycle for their keys.

Creating a Customer Managed Key (CMK)

Log in to the AWS Management Console. Navigate to AWS KMS. Click Create key. Choose Symmetric or Asymmetric key type.

Define an alias and description. Tags are optional.

Administrative permissions for the key.

Set key usage permissions.

It will create a policy based on administrative and usage permissions.

{ “Id”: “key-consolepolicy-3”, “Version”: “2012–10–17”, “Statement”: [ { “Sid”: “Enable IAM User Permissions”, “Effect”: “Allow”, “Principal”: { “AWS”: “arn:aws:iam::accountid:root” }, “Action”: “kms:”, “Resource”: “” }, { “Sid”: “Allow access for Key Administrators”, “Effect”: “Allow”, “Principal”: { “AWS”: “arn:aws:iam::account:user/terraform” }, “Action”: [ “kms:Create”, “kms:Describe”, “kms:Enable”, “kms:List”, “kms:Put”, “kms:Update”, “kms:Revoke”, “kms:Disable”, “kms:Get”, “kms:Delete”, “kms:TagResource”, “kms:UntagResource”, “kms:ScheduleKeyDeletion”, “kms:CancelKeyDeletion”, “kms:RotateKeyOnDemand” ], “Resource”: “” }, { “Sid”: “Allow use of the key”, “Effect”: “Allow”, “Principal”: { “AWS”: “arn:aws:iam::AccountID:user/application-nonprod” }, “Action”: [ “kms:Encrypt”, “kms:Decrypt”, “kms:ReEncrypt”, “kms:GenerateDataKey”, “kms:DescribeKey” ], “Resource”: “” }, { “Sid”: “Allow attachment of persistent resources”, “Effect”: “Allow”, “Principal”: { “AWS”: “arn:aws:iam::AccountID:user/application-nonprod” }, “Action”: [ “kms:CreateGrant”, “kms:ListGrants”, “kms:RevokeGrant” ], “Resource”: “*”, “Condition”: { “Bool”: { “kms:GrantIsForAWSResource”: “true” } } } ] }

More users can be allowed in the policy if they want to use the same KMS.

Now click on Next, review, and create.

Using KMS for

Share CMK alias or ARN with the Dev Team. Use AWS SDKs, CLI, or services like S3, EBS, RDS to encrypt data with KMS. Example (CLI): aws kms encrypt — key-id alias/my-key — plaintext fileb://data.txt — output text — query CiphertextBlob

Enable automatic key rotation for CMKs: Go to the key details page.

Key material and rotations

Edit Automatic key rotation (only for symmetric CMKs). Define the time window that your infosec team suggests.

Note -: Automatic key rotation is not supported for asymmetric keys in most major cloud providers (including AWS and Google Cloud). Because public and private key pairs must be actively distributed and updated in applications, asymmetric keys require manual rotation.

On-demand key rotation Simply click on Rotate now for the ondema rotation.

and click on the rotate key.

Note: You can initiate on-demand key rotation a maximum of 25 times.

How to Encrypt and Decrypt Data using KMS.

Configure AWS CLI before that, and run the aws configure command to set up the application user credentials.

1. Create a Sample File.

Create a file secret.txt using echo to test the encryption.

[root@TestServer ~]# echo “This is a highly confidential message.” > secret.txt

2. Encrypt the File

[root@TestServer ~]# aws kms encrypt — key-id alias/Test — plaintext fileb://secret.txt — output text — query CiphertextBlob > encrypted.txt

• fileb://: Tells the CLI to process the file as raw binary, which prevents encoding issues.
• --query CiphertextBlob: Extracts only the encrypted base64-encoded string from the AWS response.

We provide a Customer Managed Key (CMK) ID and the plaintext string. KMS uses the master key to encrypt the payload and outputs an encrypted base64-encoded blob.

Create Data key.

Create Data key

Encrypt data using the data key.

Encrypt data using data key

3. Decrypt the File

[root@TestServer ~]# aws kms decrypt — ciphertext-blob fileb://<(base64 — decode encrypted.txt) — output text — query Plaintext | base64 — decode > decrypted.txt

Please check (double hyphens (-) after copy data)

Note: it is decoding base64 and decrypting.

[root@TestServer ~]# cat decrypted.txt

This is a highly confidential message.

We feed the ciphertext blob back to KMS. The service verifies IAM permissions, uses the corresponding private/symmetric master key to unlock it, and returns the original plaintext

Key Deletion

Click on Schedule key deletion (minimum 7-day waiting period):

aws kms schedule-key-deletion — key-id <key-id> — pending-window-in-days 30

Auditing and Monitoring

AWS CloudTrail to log all KMS API calls.

CloudWatch alarms for unusual activity.

Security Best Practices Use the least privilege principle for IAM roles and policies. Enable automatic key rotation. Regularly audit key usage and access logs. Avoid hardcoding key IDs or secrets in code.

AWS KMS pricing

Each AWS KMS key that you create in AWS KMS costs $1/month (prorated hourly). The $1/month charge is the same for symmetric keys, asymmetric keys, HMAC keys, multi-Region keys (each primary and each replica multi-Region key), keys with imported key material, and KMS keys with a key origin of either AWS CloudHSM or an external key store (XKS).

For KMS keys that you rotate automatically or on demand, the first and second rotation of the key adds $1/month (prorated hourly) in cost. This price increase is capped at the second rotation, and any subsequent rotations will not be billed.

API request to KMS In Mumbai region.

$0.03 per 10,000 requests $0.03 per 10,000 requests involving RSA 2048 keys $0.10 per 10,000 ECC GenerateDataKeyPair requests $0.15 per 10,000 asymmetric requests except RSA 2048 $12.00 per 10,000 RSA GenerateDataKeyPair requests Note 1: While you are not charged for creation and storage of AWS-managed keys, you will be charged on any API request made to AWS-managed keys. Note 2: When you use a KMS key in a different AWS account, the AWS account that makes the API request is charged for the key use.

**https://aws.amazon.com/kms/pricing/**