AWS Key Management Service

AWS Key Management Service. It is a managed service that enables the creation and control of cryptographic keys used to protect data across a wide array of Amazon Web Services and within custom applications. The service integrates with AWS CloudTrail to provide logs of all key usage for auditing and compliance purposes. By centralizing key management, it simplifies the process of encrypting data and meeting stringent regulatory requirements.

Overview

Introduced by Amazon Web Services in 2014, this service provides a foundational layer for data security within the AWS Cloud. It is designed to work seamlessly with other major services like Amazon S3, Amazon EBS, and Amazon RDS to encrypt stored data. The underlying hardware security modules are validated under FIPS 140-2, ensuring a high standard of physical security. Its architecture supports multi-tenant isolation, a critical feature for customers in regulated industries such as finance and healthcare.

Key concepts

The primary resource is the customer master key, a logical representation of a cryptographic key material that can be used for encryption and decryption operations. Data keys are generated by the service and can be used outside of Amazon Web Services infrastructure for local encryption tasks. Key policies are JSON documents that define access permissions, similar in function to AWS Identity and Access Management policies for other resources. The concept of key rotation is automated, periodically generating new cryptographic material for enhanced security.

Features

A central feature is the ability to import your own key material, allowing organizations to maintain control over keys generated in their own HSM appliances. The service supports symmetric encryption using the Advanced Encryption Standard algorithm and asymmetric encryption for use cases like digital signatures. Integration with AWS CloudHSM provides dedicated, single-tenant HSM instances for customers with the most stringent requirements. Automatic key rotation and comprehensive auditing via AWS CloudTrail are standard capabilities.

Integration with AWS services

It is natively integrated with over one hundred Amazon Web Services. For example, Amazon S3 can use it for server-side encryption of objects, while Amazon Redshift can encrypt entire data warehouses. Services like AWS Lambda and Amazon DynamoDB can leverage it for encrypting environment variables and table data, respectively. The AWS Secrets Manager service uses it as its underlying encryption mechanism for protecting sensitive information like database passwords and API keys.

Security and compliance

The service operates within secure facilities that are part of the global AWS Global Infrastructure, which includes regions like US East (N. Virginia) and Europe (Ireland). All key management operations are logged and monitored using AWS CloudTrail, which is crucial for audits and demonstrating compliance with standards like PCI DSS, HIPAA, and the General Data Protection Regulation. The use of FIPS 140-2 validated hardware ensures the physical security of the underlying key storage.

Pricing

Pricing is based on monthly active customer master keys and the number of cryptographic requests made, such as GenerateDataKey or Decrypt API calls. The first twenty keys per month are free in each AWS Region, which benefits small-scale applications. There are no upfront costs or long-term commitments, aligning with the pay-as-you-go model common across Amazon Web Services. Costs for requests are typically fractions of a cent per ten thousand operations. Category:Amazon Web Services Category:Cryptography Category:Cloud computing