Improve data control for customers with AWS KMS
summary
Zoom and AWS demonstrate a live customer managed key pattern using AWS KMS and CloudTrail where Zoom routes encrypt/decrypt requests through a Zoom Key Broker that makes cross‑account KMS calls to customer keys, encrypts meeting recordings, chat, voicemail and tokens with per‑object data keys (envelope encryption), and logs every KMS API call. Providers reduce cost and latency with data key caching (typical TTL ≈ 5 minutes), use multi‑region keys for DR, and rely on annual KMS key rotation with no re‑encryption required.
AI-written summary · about
chapters (20)
- 0:00Intro
- 2:31Motivations
- 3:36Approaches to a solution
- 5:11Everything starts with a key
- 7:09Key store options for AWS KMS key
- 8:49How your AWS KMS key is used for encryption
- 10:52Envelope encryption primer
- 12:50Data and AWS KMS keys in the same account
- 13:03Data and AWS KMS keys in different accounts
- 13:50Shared responsibility
- 15:43Customer conversations
- 18:03Introducing "Zoom Customer Managed Key"
- 19:17Zoom Customer Managed Key architecture
- 24:21Protect certain data at rest within the Zoom cloud
- 26:27Greater transparency and control over your keys
- 32:25Data key caching: Considerations
- 37:20Observability: Use encryptionContext
- 38:57Observability: Key access logging
- 39:53Use multi-Region keys
- 44:57Key rotation
related talks
51mUsing Key Management Service for data protection
27mEncrypting 6 Petabytes of Customer Data with AWS KMS
45mLet's Encrypt Everything, Really Everything
26mProtecting your data in Amazon S3
47mEnd-to-end Encryption in Cloud Services
28mYour Secrets in Cloud-Based Key Management Services
20mApplication Secret Management with AWS KMS
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!