Encryption, KMS Keys and Secrets

What it is

Data protection has two parts. Encryption at rest and in transit stops someone who gets the bytes from reading them, and secret management stops credentials from living in code, templates or images.

AWS Key Management Service (KMS) is the central service for keys. Most AWS storage services integrate with it, so you choose a key and the service handles the encryption.

How it works

Key types

Choose customer managed keys when you need cross account sharing, custom key policies, audit of key use per key, or the ability to disable a key.

Key policies and grants

Every KMS key has a key policy, and it is the primary access control. IAM policies can grant access to the key only if the key policy allows that, usually through a statement that enables IAM policies for the account. A grant gives a specific principal narrow permission that can later be retired, and AWS services use grants behind the scenes.

To let another account use a key, the key policy must allow that account, and the other account must also give its own principals IAM permission.

{
  "Sid": "AllowUseByAuditAccount",
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::444455556666:root"},
  "Action": ["kms:Decrypt", "kms:DescribeKey"],
  "Resource": "*"
}

Envelope encryption

KMS encrypts only small amounts of data directly. For larger data, you ask KMS for a data key, encrypt the data locally with the plaintext key, store the encrypted data key beside the ciphertext, and discard the plaintext key.

To decrypt, KMS decrypts the data key first. This is envelope encryption, and the AWS SDK and most services do it for you.

Rotation, deletion and Regions

• Automatic rotation of customer managed symmetric keys creates new key material while keeping the same key ID, so data stays readable.
• Key deletion has a mandatory waiting period (7 to 30 days) so you can cancel it. Disable a key first to test the effect.
• Keys are Regional. Multi Region keys have the same key ID and material across Regions (the ID starts with mrk-), which supports encrypting in one Region and decrypting in another for DR and global tables.

aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab
aws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
  --pending-window-in-days 14

Encryption in common services

Enforce encryption in transit with bucket policies using aws:SecureTransport, TLS listeners on load balancers and certificates from AWS Certificate Manager (ACM). ACM renews public certificates automatically when validation by DNS remains in place, for supported integrated services.

{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"],
  "Condition": {"Bool": {"aws:SecureTransport": "false"}}
}

Secrets Manager and Parameter Store

aws secretsmanager rotate-secret --secret-id prod/db \
  --rotation-lambda-arn arn:aws:lambda:us-east-1:111122223333:function:rotate-db \
  --rotation-rules AutomaticallyAfterDays=30

Applications fetch the secret at runtime through the role, so the value never sits in code, user data or an image. CloudFormation can pass secrets with dynamic references, and CodeBuild reads them in the buildspec. For RDS, Secrets Manager can manage the master user password and rotate it automatically.

Data discovery

Amazon Macie scans S3 for sensitive data, such as personal identifiers, and reports findings. S3 Block Public Access, applied at the account level, prevents accidental public buckets.