Who controls the key

Using AWS Security for Developers

Rahul Singh

Technical Product Manager

Two kinds of KMS key

AWS managed

  • Created by the service, alias aws/s3
  • Policy readable, not editable
  • No monthly charge

Two stacked cards comparing an AWS managed key with a customer managed key across the same three rows: key policy, rotation and cost. The key policy row of the customer managed card is highlighted. Each card carries its alias: aws slash s3 and alias slash reports.

Using AWS Security for Developers

Two kinds of KMS key

AWS managed

  • Created by the service, alias aws/s3
  • Policy readable, not editable
  • No monthly charge

Customer managed

  • Created by you, alias alias/reports, policy yours to write
  • Rotation period yours to set
  • One dollar per month, per key

Two stacked cards comparing an AWS managed key with a customer managed key across the same three rows: key policy, rotation and cost. The key policy row of the customer managed card is highlighted. Each card carries its alias: aws slash s3 and alias slash reports.

Using AWS Security for Developers

Two gates, and both must open

One decrypt request approaching the first of two gates. The IAM policy gate is drawn solid and numbered one, the key policy gate behind it is dashed and gray, and neither has answered yet.

  1. IAM policy: what the caller may ask for
Using AWS Security for Developers

Two gates, and both must open

One decrypt request passing left to right through two numbered gates, marker one the IAM policy and marker two the key policy, before it reaches the KMS key. A bracket under the two gates labels them independent answers.

  1. IAM policy: what the caller may ask for
  2. Key policy: who the key will answer

Default key policy: delegates to IAM

Grants: specific key operations for one principal, revocable on its own

Using AWS Security for Developers

The key never touches your data

Amazon S3, acting on your behalf, calls AWS KMS at marker one, and KMS returns one data key as a plaintext copy and an encrypted copy. The encrypted copy is stored beside the object ciphertext, and a dashed return path at marker two carries it back through a decrypt call.

Envelope encryption

Direct encryption: a 4 KB ceiling

Using AWS Security for Developers

The key never touches your data

Amazon S3, acting on your behalf, calls AWS KMS at marker one, and KMS returns one data key as a plaintext copy and an encrypted copy. The encrypted copy is stored beside the object ciphertext, and a dashed return path at marker two carries it back through a decrypt call.

Envelope encryption

Direct encryption: a 4 KB ceiling

  1. GenerateDataKey, two copies back
  2. kms:Decrypt on the stored copy
Using AWS Security for Developers

Across accounts, nobody sees both halves

Caller's account

  • Action allowed in IAM
  • Resource: the key ARN

Two dashed account panels separated by an account boundary. The caller's role and IAM policy sit in the upper panel, the key policy and the KMS key sit in the lower panel, and the request crosses the boundary between them.

Using AWS Security for Developers

Across accounts, nobody sees both halves

Caller's account

  • Action allowed in IAM
  • Resource: the key ARN

Key owner's account

  • Key policy naming the caller
  • The account, or a role in it

Two dashed account panels separated by an account boundary. The caller's role and IAM policy sit in the upper panel, the key policy and the KMS key sit in the lower panel, and the request crosses the boundary between them.

Using AWS Security for Developers

Read the denial, not the guess

Identity based

  • AccessDeniedException, then the clause that names the gate

  • no identity-based policy allows

  • Fix the caller's IAM policy

 

A decrypt request stopped at the first gate, where the IAM policy carries a red cross and the key policy behind it is grayed out and never reached. A caption below the diagram reads: no identity-based policy allows.

 

Using AWS Security for Developers

Read the denial, not the guess

Identity based

  • AccessDeniedException, then the clause that names the gate

  • no identity-based policy allows

  • Fix the caller's IAM policy

Resource based

  • no resource-based policy allows
  • Fix the key policy

A decrypt request stopped at the first gate, where the IAM policy carries a red cross and the key policy behind it is grayed out and never reached. A caption below the diagram reads: no identity-based policy allows.

A decrypt request passing a green-ticked IAM policy and then stopped at the second gate, where the key policy carries a red cross. A caption below the diagram reads: no resource-based policy allows.

Using AWS Security for Developers

What rotation actually changes

Automatic rotation

  • Default 365 days
  • Range 90 to 2,560 days

Three cards giving the minimum, default and maximum automatic rotation periods in days, above three rows showing which kinds of key rotate and on whose schedule.

Using AWS Security for Developers

What rotation actually changes

Automatic rotation

  • Default 365 days
  • Range 90 to 2,560 days

On demand

  • RotateKeyOnDemand, up to 25 times per key

Two limits

  • AWS managed keys, fixed at yearly
  • Automatic rotation: symmetric, KMS-generated material only

Three cards giving the minimum, default and maximum automatic rotation periods in days, above three rows showing which kinds of key rotate and on whose schedule.

Using AWS Security for Developers

What rotation does not fix

Four rows compared either side of a rotation line. The key material row changes from version one to version two, while the key identifier, the alias and key policy, and the objects written earlier are identical on both sides.

Changes: the backing key material

Unchanged: key ID, ARN, aliases, key policy

Using AWS Security for Developers

What rotation does not fix

Four rows compared either side of a rotation line. The key material row changes from version one to version two, while the key identifier, the alias and key policy, and the objects written earlier are identical on both sides.

Changes: the backing key material

Unchanged: key ID, ARN, aliases, key policy

  • Nothing in your code to change
  • Old objects, and an over-broad policy: both unchanged
Using AWS Security for Developers

So why switch it on

What it buys

  • One version never covers all your data
  • Compliance and contract rules that mandate rotation

A green card headed what it buys, under the label turning rotation on. It gives an audit rule reading rotate every 365 days with a green tick, and one key drawn as three joined versions, v1, v2 and v3, captioned that each covers only what it wrote.

Using AWS Security for Developers

So why switch it on

What it buys

  • One version never covers all your data
  • Compliance and contract rules that mandate rotation

 

What it costs

  • No code change, nothing to re-encrypt

The same green what it buys card, now with a second card below it headed what it costs. That card gives two rows: your code, unchanged, and old objects, no re-encryption.

Using AWS Security for Developers

Let's practice!

Using AWS Security for Developers

Preparing Video For Download...