# AWS KMS

> AWS's vault for encryption keys: you use them, but they never leave.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/aws-kms/
- In Spanish: [AWS KMS](https://tidbit.legios.com.ar/es/aws-kms/)

Encryption is only as good as the protection of its keys. Store the key next to the data and a thief takes both. **KMS** (Key Management Service) solves that on AWS: it creates and keeps encryption keys inside dedicated, tamper-resistant hardware, and you never get to see or download the key itself. You send data to KMS and ask it to encrypt or decrypt, and IAM decides who is allowed to ask.

For large files it uses a trick called **envelope encryption**. KMS generates a fresh **data key**, which encrypts the file locally; then the KMS key encrypts that data key, and the encrypted data key is stored next to the file. To read the file, a service asks KMS to unlock the small data key. The big file never travels to KMS, and the master key never leaves it.

Most AWS services plug into KMS with a checkbox: Amazon S3 buckets, Amazon EBS disks, Amazon RDS databases and many more encrypt their data with a KMS key. Every use of a key is logged in AWS CloudTrail, so you can see who decrypted what. And because the key is the only way back to the data, deleting a KMS key is deliberately slow: AWS makes you wait a period of days first, in case it was a mistake.

## An analogy

A bank vault with a teller window. You never get the master key; you hand the teller your small lockbox key, they lock or unlock it behind the glass, and every visit is written in the bank's ledger.

## Keep in mind

- Keys are created and used inside KMS; their raw material never leaves.
- Envelope encryption: a data key encrypts the data, a KMS key encrypts the data key.
- Built into S3, EBS, RDS and most other AWS services.
- IAM controls who can use each key, and CloudTrail logs every use.

## Go deeper

- [AWS Key Management Service (official docs)](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)
- [AWS KMS](https://aws.amazon.com/kms/)
- [Key management on Wikipedia](https://en.wikipedia.org/wiki/Key_management)

## Related terms

- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.
- [IAM](https://tidbit.legios.com.ar/iam/): The rulebook that says who can do what in your AWS account.
- [Amazon S3](https://tidbit.legios.com.ar/amazon-s3/): A giant online drawer for files, rented by the gigabyte.
- [Amazon EBS](https://tidbit.legios.com.ar/amazon-ebs/): The virtual hard drive of an EC2 instance, kept alive even when the instance stops.
- [Amazon RDS](https://tidbit.legios.com.ar/amazon-rds/): A ready-made relational database that AWS keeps patched, backed up and running.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [AWS CloudTrail](https://tidbit.legios.com.ar/aws-cloudtrail/): The logbook of an AWS account: who did what, when, and from where.