KMS Keys, Policies and Grants

What it is

AWS Key Management Service (KMS) creates and controls cryptographic keys used to protect data. Most AWS services integrate with it, so a KMS key policy is often what decides who can read encrypted data.

The exam focuses on key types, access, envelope encryption, and what happens when a key is disabled or deleted.

How it works

Key types

Use a customer managed key when you need control: cross account sharing, custom rotation, restricted usage, or the ability to disable or delete the key. Keys can be symmetric, asymmetric, or HMAC (hash based message authentication code) keys.

Key policy is the root of access

A KMS key always has a key policy, and access requires the key policy to allow it. IAM policies can grant access only if the key policy contains a statement that enables IAM, usually by trusting the account root.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EnableIAMPolicies",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::111122223333:root" },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "AllowUseByAppRole",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::111122223333:role/AppRole" },
      "Action": ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey"],
      "Resource": "*",
      "Condition": { "StringEquals": { "kms:ViaService": "s3.us-east-1.amazonaws.com" } }
    }
  ]
}

The first statement lets IAM policies in the account manage access. The second allows one role to use the key, but only through S3 in that Region, because of the kms:ViaService condition. In a key policy, Resource is * and refers to the key itself.

Separate duties. Key administrators manage the key (create, rotate, disable) but should not be allowed to use it for encryption or decryption. Key users use it but cannot change the policy.

Grants

A grant is a specific permission on a key that can be retired or revoked, created with CreateGrant.

AWS services use grants to act for you, for example EBS asks KMS for a grant to encrypt and decrypt a volume. A grant can be retired or revoked. Use them to delegate key use programmatically without editing the key policy.

Envelope encryption

KMS encrypts only small data directly, up to 4 KB. For larger data, use envelope encryption.

1. Call GenerateDataKey. KMS returns a plaintext data key and the same key encrypted under the KMS key.
2. Use the plaintext data key to encrypt the data locally, then discard it from memory.
3. Store the encrypted data key next to the encrypted data.
4. To decrypt, send the encrypted data key to KMS with Decrypt, and use the returned plaintext key.

# AWS CLI: create a customer managed key and an alias
aws kms create-key --description "app data key"
aws kms create-alias --alias-name alias/app-data \
  --target-key-id 1234abcd-12ab-34cd-56ef-1234567890ab

Encryption context

Encryption context is a set of non secret key value pairs bound to the encryption. The same context is needed to decrypt, and it appears in CloudTrail logs, so it adds integrity and audit information. You can write policy conditions on kms:EncryptionContext: keys.

Cross account use

To let account B use a key in account A, two things must be true. The key policy in account A must allow account B (or a principal in it), and account B's IAM policy must allow the principal to call KMS on that key ARN. AWS managed keys cannot be shared across accounts, so use a customer managed key for any cross account design such as shared encrypted snapshots.

Rotation

Automatic rotation creates new key material for a customer managed symmetric key on a schedule, which defaults to yearly. The key ID and ARN stay the same, and older material remains available so previously encrypted data still decrypts. Keys with imported material do not rotate automatically, and support for other key types is narrower, so plan manual rotation for them.

Disabling and deleting

A disabled key cannot be used, and you can enable it again. Deleting a key requires a waiting period of 7 to 30 days, during which it is unusable and the deletion can be cancelled. After the period, the key and its material are gone, and anything encrypted under it is unrecoverable.

Monitoring and troubleshooting

CloudTrail records KMS calls with the key ID and encryption context. A decrypt failing with AccessDenied is usually the key policy, the missing IAM allow in a cross account design, a missing grant, a disabled key, or a condition such as kms:ViaService that does not match the calling service.