AWS KMS
AWS's vault for encryption keys: you use them, but they never leave.
Encryption is only as good as the protection of its keys. Store the key next to the data and a thief takes both. KMS (Key Management Service) solves that on AWS: it creates and keeps encryption keys inside dedicated, tamper-resistant hardware, and you never get to see or download the key itself. You send data to KMS and ask it to encrypt or decrypt, and IAM decides who is allowed to ask.
For large files it uses a trick called envelope encryption. KMS generates a fresh data key, which encrypts the file locally; then the KMS key encrypts that data key, and the encrypted data key is stored next to the file. To read the file, a service asks KMS to unlock the small data key. The big file never travels to KMS, and the master key never leaves it.
Most AWS services plug into KMS with a checkbox: Amazon S3 buckets, Amazon EBS disks, Amazon RDS databases and many more encrypt their data with a KMS key. Every use of a key is logged in AWS CloudTrail, so you can see who decrypted what. And because the key is the only way back to the data, deleting a KMS key is deliberately slow: AWS makes you wait a period of days first, in case it was a mistake.
Keep in mind
- Keys are created and used inside KMS; their raw material never leaves.
- Envelope encryption: a data key encrypts the data, a KMS key encrypts the data key.
- Built into S3, EBS, RDS and most other AWS services.
- IAM controls who can use each key, and CloudTrail logs every use.
