AWS KMS-What is CMK, DataKey, Envelop Encryption & How it works ?

What is KMS ?

• Key Management Service (KMS) is a managed service to create and control the encryption keys which used to encrypt your data.
• KMS is a global Service and Keys are regional.
• KMS supports both Symmetric and Asymmetric keys.

KMS Usage ?

KMS keys integrated across various AWS services like:

• Encrypting EBS volumes
• Encrypting DynamoDB tables
• Encrypting S3 objects
• Encrypting the events in SQS Queue
• Encrypting the messages in Kinesis Stream

KMS integration with Secret Manager

• Secrets Manager integrates with KMS to encrypt your secret with a unique data key. When you create a new secret in Secret Manager, you get the option to choose which KMS key you want to encrypt your secret.
• It is impossible to create a new secret using Secrets Manager without an encryption key managed by KMS. Secrets Manager provides a default key that you can use or create your own KMS key to encrypt the secrets

Customer Master Key:

• Customer Master Key (CMK) is a logical representation of key can be generated by KMS
• CMK never leaves KMS (or) a region.
• Note: CMK can handle encryption / decryption upto 4kb of data
• What if you want to encrypt the data > 4kb ? Then we have option called Envelop Encryption.

Customer Master Key — has two flavours.

If you would like to manage keys on your own, let’s say enabling/disabling keys & manage access policy and rotate key every year, then you can prefer “Customer Managed CMK”.

If you want AWS to manage on your behalf, you can prefer “AWS Managed CMK”, which will be limited to specific AWS Services and cannot be deleted.

Why Envelop Encryption ?

• KMS Encrypt API call has a limit of 4 KB
• Anything over 4 KB of data that needs to be encrypted must use the Envelope Encryption
• If you want to encrypt >4 KB, we need to use Envelope Encryption

What is Data Key ?

• Data keys are encryption keys that you can use to encrypt data, including large amounts of data
• AWS KMS customer master keys (CMKs) used to generate, encrypt, and decrypt data keys.
• Data Keys used outside of KMS to encrypt and decrypt large volume of data

Customer Master Key (CMK) vs Data Key

• CMK does not leave KMS or AWS Region
• CMK can encrypt data having max size 4kb
• CMK used to generate, encrypt and decrypt the data keys
• Data Key resides outside of KMS
• Data Key has no limit on data volume / size
• Data Key only for encryption and decryption.

How Envelop Encryption works ?

Case 1: Generate Data Key.

• Client request for Data Key to KMS
• KMS returns Plain Data Key and Encrypted Data Key
• Client holds both Plain-Data-Key and Encrypted-Data-Key

Case 2: Encryption Phase

• Client has Plain Data & Plain-Data-Key
• Client encrypts the Plain Data using Plain-Data-Key
• Once encryption is done, Client deletes Plain-Data-Key
• Client preserves Encrypted Data and Encrypted-Data-Key

Case 3: Decryption Phase

• Client has Encrypted Data & Encrypted-Data-Key
• Client requests KMS to decrypt the Encrypted-Data-Key
• KMS returns Plain-Data-Key
• Client leverage Plain-Data-Key to decrypt the Encrypted Data
• Once decryption is done, Client deletes Plain-Data-Key

Envelop Encryption — Data Key Generation, Encryption and Decryption Scenarios

Conclusion:

Never ever store your secrets in plaintext, especially in your code! And it is very important to have Data at rest encrypted for compliance standards. Leverage KMS Customer Master Keys or Data Keys for encryption based on data size.