Encryption on AWS: KMS keys, envelope encryption and key policies

Encryption at rest and in transit

Encryption at rest protects stored data if disks, backups or snapshots are copied. Encryption in transit protects data moving over networks. On AWS most services encrypt at rest by default, and almost every API endpoint uses TLS. The security question is really about who controls the keys and who can use them. If you need a refresher on algorithms, see cryptography basics.

How KMS works

AWS Key Management Service (KMS) stores keys inside hardware security modules (HSMs) validated under FIPS 140-3. The key material never leaves KMS in plaintext. Because KMS can only encrypt small amounts of data directly (up to 4 KB), services use envelope encryption.

To read the data later, the service sends the wrapped data key to KMS, KMS checks permissions and returns the plaintext data key, and the service decrypts locally. Every one of those KMS calls is logged in CloudTrail, which gives you an audit trail of who used which key.

Customer managed keys are the ones to use for sensitive data, because you write the key policy, can disable the key in an emergency, and see every use.

Key policies, grants and rotation

• Every KMS key has a key policy. Unlike most AWS resources, IAM policies alone cannot grant access unless the key policy allows the account to delegate to IAM.
• Separate duties: key administrators manage the key but cannot use it to decrypt; key users can encrypt and decrypt but cannot change the policy.
• Grants give temporary, narrow permissions, often used by services such as EBS on your behalf.
• Enable automatic rotation for customer managed symmetric keys. Rotation creates new key material, while old material is kept to decrypt older data, so nothing needs re-encrypting.
• Key deletion has a mandatory waiting period of 7 to 30 days. Deleting a key makes all data encrypted with it unrecoverable, so prefer disabling first.

aws kms create-key --description "App data key" --key-usage ENCRYPT_DECRYPT
aws kms enable-key-rotation --key-id <key-id>
aws kms create-alias --alias-name alias/app-data --target-key-id <key-id>

Related services and common mistakes

Common mistakes:

• Key policies that let "Principal": "*" use the key without conditions.
• Using one key for everything, so a single policy mistake exposes all data.
• Forgetting that sharing an encrypted snapshot also needs the key to be shared.
• Scheduling a key for deletion without checking what still uses it.