Security is a critical part of managing workloads in AWS. AWS Key Management Service<\/a> (AWS KMS) makes it easier to create and manage cryptographic keys that can be used to protect data across AWS services<\/a>.<\/span><\/p>\n Create an AWS KMS Key<\/strong> through the AWS KMS console by selecting the key type, configuring administrators and key users, reviewing the key policy, and creating the key. The KMS key can then be used to protect data across supported AWS services.<\/p>\n AWS Key Management Service<\/a> (KMS) is a managed service that allows you to create and control cryptographic keys used to protect data. AWS services can use KMS keys to encrypt data at rest, while KMS handles the underlying cryptographic operations and access control.<\/span><\/p>\n KMS keys can be used with services such as:<\/span><\/p>\n Before creating the KMS key, make sure you have:<\/span><\/p>\n Log in to the AWS Management Console and open:<\/span><\/p>\n AWS KMS \u2192 Customer managed keys<\/b><\/p>\n Click: <\/span>Create key<\/b><\/p>\n Under <\/span>Key type<\/b>, select: <\/span>Symmetric<\/b><\/p>\n Under <\/span>Key usage<\/b>, select: <\/span>Encrypt and decrypt<\/b><\/p>\n Then click: <\/span>Next<\/b><\/p>\n Provide a meaningful alias. For example: <\/span>alias\/prod-data-encryption<\/b><\/p>\n Click: <\/span>Next<\/b><\/p>\n AWS KMS allows you to specify which IAM users or roles can administer the key. Typical administrative permissions include:<\/span><\/p>\n Next, select the IAM users or roles that should be allowed to use the key. The exact permissions required depend on how the key will be used. For an application that needs encryption and decryption, permissions may include:<\/span><\/p>\n kms:Encrypt<\/b><\/p>\n kms:Decrypt<\/b><\/p>\n kms:GenerateDataKey<\/b><\/p>\n kms:DescribeKey<\/b><\/p>\n For AWS services, the required permissions can vary depending on the service.<\/span><\/p>\n AWS KMS uses a <\/span>key policy<\/b> to control access to a KMS key. A simplified example looks like:<\/span><\/p>\n \u00a0\u00a0“Version”: “2012-10-17”,<\/span><\/p>\n \u00a0\u00a0“Statement”: [<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0{<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Sid”: “Enable IAM User Permissions”,<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Effect”: “Allow”,<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Principal”: {<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“AWS”: “arn:aws:iam::123456789012:root”<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0},<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Action”: “kms:*”,<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Resource”: “*”<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0}<\/span><\/p>\n \u00a0\u00a0]<\/span><\/p>\n }<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n The root principal in a KMS key policy does not mean that the AWS account root user is the only person who can use the key. It establishes account-level control that can allow IAM policies to grant access. However, KMS policies should be designed carefully according to the principle of least privilege.<\/span><\/p>\n Click: <\/span>Finish<\/b><\/p>\n The KMS key is now created.<\/span><\/p>\n After creating the key, open:<\/span><\/p>\n AWS KMS \u2192 Customer managed keys<\/b><\/p>\n You should see something similar to:<\/span><\/p>\n Alias<\/span><\/p>\n alias\/prod-data-encryption<\/span><\/p>\n Key ID<\/span><\/p>\n 12345678-abcd-1234-abcd-123456789012<\/span><\/p>\n Key ARN<\/span><\/p>\n arn:aws:kms:ap-south-1:123456789012:key\/12345678-abcd-1234-abcd-123456789012<\/span><\/p>\n The <\/span>Key ID<\/b> or <\/span>Key ARN<\/b> can be used when configuring AWS services.<\/span><\/p>\n Before attaching the key to production resources, you can verify that it is enabled. Run:\u00a0<\/span><\/p>\nAWS KMS Key Creation at a Glance<\/strong><\/span><\/h3>\n
What is AWS KMS?<\/b><\/h2>\n
\n
Prerequisites<\/b><\/h2>\n
\n
Create a KMS Key Using AWS Console<\/b><\/h1>\n
Select Key Type<\/b><\/h2>\n
Add Key Details<\/b><\/h2>\n
Configure Key Administrators<\/b><\/h2>\n
\n
Configure Key Users<\/b><\/h2>\n
Review the Key Policy<\/b><\/h2>\n
\n\n
\n {<\/span><\/p>\n Find the KMS Key ID<\/b><\/h2>\n
Test the KMS Key<\/b><\/h2>\n