Using Key Management Service for data protection
summary
AWS KMS explains concrete mechanics: keys live only inside FIPS‑validated HSMs, KMS uses AES-256-GCM for data keys, and envelope encryption wraps per‑object data keys with KMS keys. AWS reports about 350 billion data keys a month and adds an on‑HSM HMAC API this week so signing keys never leave the module. Recommendations: prefer customer‑managed keys, avoid routine rotation unless required, and use S3 bucket keys (customers report up to 99.99% fewer KMS calls) plus encryption context, VPC endpoint policies, and attribute‑based access for tighter audit and separation of duties.
AI-written summary · about
chapters (17)
- 0:00Intro
- 4:06AWS KMS high-level components Amazon managed web service with
- 6:00How can I use AWS KMS?
- 10:12Data protection terms
- 18:10Can AWS see my keys?
- 21:39Protection best practices
- 22:52Customer-managed keys give you most flexibility
- 27:032. Common drivers for key rotation
- 30:52Use encryption context
- 32:10Harden HMACs Inside KMS HSMS • HMACs are great crypto building blocks
- 33:54Several orders of magnitude in how encryption operates at AWS
- 36:35Amazon S3 bucket keys deliver 10-1000X API savings
- 39:48Using data key caching in the AWS Encryption SDK
- 40:20Key policy best practices
- 44:55Use VPC endpoint policies to further lock down data
- 47:03Service control policies can create org-level boundaries
- 48:25Closing thoughts
related talks
45mLet's Encrypt Everything, Really Everything
20mUnderstanding the shared responsibility model and AWS KMS XKS
27mEncrypting 6 Petabytes of Customer Data with AWS KMS
50mImprove data control for customers with AWS KMS
26mProtecting your data in Amazon S3
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
58mUsing AWS data protection services for innovation and automation
28mYour Secrets in Cloud-Based Key Management Services