Key Management Service in AWS

Table of content

• Introduction
• Types of Keys
• Use Cases for AWS KMS
• Best Practices for Using AWS KMS
• Examples in TypeScript
• AWS KMS vs AWS CloudHSM
  • When to Choose CloudHSM Over KMS:

Introduction

AWS Key Management Service (KMS) is a managed service that makes it easy to create and control cryptographic keys used to secure your data. It’s integrated with other AWS services to simplify the process of encrypting your data. AWS KMS is particularly appealing to software engineers and architects due to its robust security, ease of use, and seamless integration with various AWS services.

Types of Keys

AWS KMS supports three types of keys:

1. Customer Managed Keys: Customer managed keys are KMS keys that you create, own, and manage. You have full control over these KMS keys, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, rotating their cryptographic material, adding tags, creating aliases that refer to the KMS keys, and scheduling the KMS keys for deletion.
2. AWS Managed Keys: AWS managed keys are KMS keys in your account that are created, managed, and used on your behalf by an AWS service that integrates with KMS. You can view the AWS managed keys in your account, view their key policies, and audit their use in CloudTrail logs. However, you cannot manage these AWS managed keys or change their permissions. And, you cannot use AWS managed keys in cryptographic operations directly; the service that creates them uses them on your behalf.
3. AWS Owned Keys: These keys are not in your AWS account. They are part of a collection of KMS keys that AWS owns and manages for use in multiple AWS accounts.

Use Cases for AWS KMS

• Data Encryption at Rest: Encrypt data stored in Amazon S3, EBS, RDS, and other storage services.
• Application-Level Encryption: Secure sensitive data within your applications using the AWS SDKs.
• Certificate Management: Manage SSL/TLS certificates for secure communication.
• Database Encryption: Encrypt databases hosted on AWS services like Amazon RDS, DynamoDB, and Redshift.
• Data Integrity: Ensure data has not been tampered with by using cryptographic checksums and signatures.

Best Practices for Using AWS KMS

Here are some proven practices to help you use KMS securely and effectively:

• Use Least Privilege: Limit access to keys using IAM policies and KMS key policies.
• Enable Automatic Key Rotation: For customer-managed keys to minimize risk of compromise.
• Use Aliases for Keys: Easier key referencing and lifecycle management.
• Log All Usage: Enable CloudTrail for auditing key usage.
• Encrypt Data Keys (Envelope Encryption): Avoid encrypting large payloads directly with CMKs.
• Periodically Audit Grants and Key Usage.
• Use Multi-Factor Authentication (MFA): For sensitive operations like key deletion.
• Use Tags for Key Management: Organize keys by environment, application, or owner.
• Implement Key Lifecycle Management: Regularly review and retire unused keys.
• Use AWS Organizations for Centralized Key Management: Manage keys across multiple accounts.
• Use AWS Config Rules: Monitor compliance with your key management policies.

Examples in TypeScript

Using AWS SDK for JavaScript (v3), you can easily interact with AWS KMS. Below are some examples of how to create a key, encrypt data, and decrypt data.

import { KMSClient, EncryptCommand, DecryptCommand } from '@aws-sdk/client-kms';
const client = new KMSClient();
const keyId = 'arn:aws:kms:us-east-1:123456789012:key/abcd-1234-5678-efgh'; 

async function encryptData(plainText: string): Promise<Uint8Array> {
  const command = new EncryptCommand({
    KeyId: keyId,
    Plaintext: Buffer.from(plainText),
  });
  const response = await client.send(command);
  return response.CiphertextBlob!;
}

async function decryptData(cipherText: Uint8Array): Promise<string> {
  const command = new DecryptCommand({
    CiphertextBlob: cipherText,
  });
  const response = await client.send(command);
  return Buffer.from(response.Plaintext!).toString();
}

(async () => {
  const secret = 'mySuperSecretData';
  const encrypted = await encryptData(secret);
  const decrypted = await decryptData(encrypted);

  console.log('Original:', secret);
  console.log('Decrypted:', decrypted);
})();

AWS KMS vs AWS CloudHSM

When to Choose CloudHSM Over KMS:

• You need FIPS 140-2 Level 3 certification.
• You require custom encryption algorithms or BYOK (Bring Your Own Key).
• You want full control over the HSM hardware and key lifecycle.

Otherwise, KMS is the better default choice for most applications due to its ease of use and integration.