Skip to main content

AWS Key Management Service (KMS) Learning & Revision Guide

Overview​

AWS Key Management Service (KMS) is a managed service used to create, manage, and control cryptographic keys for encrypting data across AWS services.

KMS helps organizations meet security, compliance, and data protection requirements by centralizing encryption key management.

1. What is KMS?​

KMS provides encryption keys that can be used by AWS services and applications to protect sensitive data.

Key Benefits​

  • Centralized key management
  • Data encryption
  • Access control
  • Audit logging
  • Regulatory compliance
  • Key rotation

2. Key Concepts​

Encryption​

Convert readable data into encrypted data.

Decryption​

Convert encrypted data back into readable format.

Customer Master Key (CMK)​

Historically called CMK. AWS now refers to these simply as KMS Keys.

Data Key​

Temporary encryption key generated by KMS for encrypting application data.

3. Types of KMS Keys​

AWS Managed Keys​

Keys automatically created and managed by AWS.

Examples:

aws/s3
aws/rds
aws/ebs
aws/secretsmanager

Customer Managed Keys (CMK)​

Keys created and managed by customers.

Benefits:

  • Full control
  • Custom policies
  • Key rotation
  • Cross-account access

4. Creating KMS Keys​

Key Topics​

  • Symmetric Keys
  • Asymmetric Keys
  • Key Alias
  • Key Description
  • Key Rotation
  • Key Deletion

Common Example​

Alias: prod-database-key
Purpose: RDS Encryption

5. KMS Key Policies​

Key policies determine who can use the KMS key.

Key Topics​

  • Allow encryption
  • Allow decryption
  • Cross-account access
  • Service permissions

Common Permissions​

kms:Encrypt
kms:Decrypt
kms:GenerateDataKey
kms:DescribeKey

6. IAM Policies vs Key Policies​

One of the most important KMS concepts.

IAM Policy​

Determines whether a user or role can call KMS APIs.

Key Policy​

Determines whether the KMS key itself allows access.

Access Requirement​

IAM Policy
      AND
Key Policy
      =
Access Granted

Both permissions must exist.

7. KMS Integration with AWS Services​

KMS integrates with many AWS services.

Common Integrations​

  • Amazon S3
  • Amazon EBS
  • Amazon RDS
  • AWS Secrets Manager
  • Amazon EKS
  • AWS Lambda
  • CloudWatch Logs
  • SNS
  • SQS

8. S3 Encryption with KMS​

One of the most common use cases.

Architecture​

User
   |
Amazon S3
   |
KMS Key
   |
Encrypted Object

Key Topics​

  • SSE-KMS
  • Bucket Encryption
  • Object Encryption
  • KMS Access Control

Benefits​

  • Stronger security
  • Auditability
  • Compliance support

9. EBS Encryption​

Encrypt EC2 volumes using KMS.

Key Topics​

  • Root volume encryption
  • Data volume encryption
  • Snapshot encryption
  • Default EBS encryption

Benefits​

  • Protect instance storage
  • Secure backups

10. RDS Encryption​

Encrypt relational databases using KMS.

Key Topics​

  • Database encryption
  • Snapshot encryption
  • Read replica encryption

Architecture​

Application
      |
Amazon RDS
      |
KMS Key
      |
Encrypted Storage

11. Secrets Manager Integration​

Secrets Manager relies heavily on KMS.

Architecture​

Application
      |
Secrets Manager
      |
KMS Key
      |
Encrypted Secret

Required Permissions​

secretsmanager:GetSecretValue
kms:Decrypt

12. Lambda Integration​

Lambda functions often retrieve encrypted secrets.

Architecture​

Lambda
   |
IAM Role
   |
Secrets Manager
   |
KMS Key

Required Permissions​

kms:Decrypt
secretsmanager:GetSecretValue

13. Key Rotation​

Regularly rotate encryption keys.

Key Topics​

  • Automatic rotation
  • Manual rotation
  • Compliance requirements

Benefits​

  • Reduced security risk
  • Improved compliance

14. Cross-Account Key Access​

Allow resources in another AWS account to use your KMS key.

Key Topics​

  • Key Policies
  • IAM Roles
  • Resource Sharing

Common Use Cases​

  • Shared services accounts
  • Multi-account environments

15. Monitoring and Auditing​

Monitor KMS activity.

Key Topics​

  • CloudTrail
  • CloudWatch
  • Security Auditing

Audit Events​

  • Encrypt operations
  • Decrypt operations
  • Key usage
  • Key modifications

16. Security Best Practices​

  • Use Customer Managed Keys for production workloads.
  • Enable key rotation.
  • Follow least privilege access.
  • Restrict key usage through Key Policies.
  • Audit key usage using CloudTrail.
  • Avoid unnecessary key sharing.

17. Common Production Architecture​

Application
      |
IAM Role
      |
AWS Service
      |
KMS Key
      |
Encrypted Data

Examples:

EC2 -> EBS -> KMS

Lambda -> Secrets Manager -> KMS

Application -> RDS -> KMS

User -> S3 -> KMS

Cloud Architect Checklist​

When designing encryption solutions verify:

  • Data Classification
  • Encryption Requirements
  • KMS Key Ownership
  • Key Rotation Policy
  • IAM Permissions
  • Key Policies
  • Cross-Account Access
  • Backup Encryption
  • Audit Requirements
  • Compliance Requirements

Revision Checklist​

Before considering KMS revision complete, ensure you understand:

  • KMS Basics
  • Symmetric Keys
  • Asymmetric Keys
  • AWS Managed Keys
  • Customer Managed Keys
  • Key Policies
  • IAM Policies
  • Key Rotation
  • S3 Encryption
  • EBS Encryption
  • RDS Encryption
  • Secrets Manager Integration
  • Lambda Integration
  • Cross-Account Access
  • Monitoring and Auditing

Most Important Interview Concepts​

Concept 1​

IAM Policy
      +
Key Policy
      =
Access Granted

Concept 2​

KMS does not usually encrypt large files directly.

Instead:

KMS Key
      |
Generate Data Key
      |
Encrypt Data

This approach is called Envelope Encryption.

Concept 3​

Almost every AWS security service depends on KMS:

S3
EBS
RDS
Secrets Manager
EKS
Lambda
CloudWatch Logs
SNS
SQS

Understanding KMS is essential for designing secure AWS architectures.

For your AWS learning repository, KMS should be a foundational service under Security:

AWS
└── Security
    ├── IAM
    ├── KMS
    ├── Secrets Manager
    ├── ACM
    ├── WAF
    └── Shield

A practical learning order is:

IAM
 ↓
KMS
 ↓
Secrets Manager
 ↓
S3 Encryption
 ↓
RDS Encryption
 ↓
Lambda Integration

Once these five topics are clear, you'll understand most production encryption implementations used in AWS environments.