Bird
Raised Fist0
AWScloud~5 mins

KMS for key management in AWS - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Introduction
Managing secret keys safely is important to protect your data. AWS KMS helps you create and control encryption keys easily without handling them yourself.
When you want to encrypt sensitive data like passwords or credit card numbers in your app.
When you need to control who can use encryption keys in your team or company.
When you want to audit how and when keys are used for security reviews.
When you want to rotate encryption keys automatically to keep them secure.
When you want to integrate encryption with other AWS services like S3 or RDS.
Commands
This command creates a new encryption key in AWS KMS with a description and a tag to identify its purpose.
Terminal
aws kms create-key --description "Example key for encrypting app data" --tags TagKey=Purpose,TagValue=AppEncryption
Expected OutputExpected
{ "KeyMetadata": { "AWSAccountId": "123456789012", "KeyId": "abcd1234-5678-90ef-ghij-klmnopqrstuv", "Arn": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-5678-90ef-ghij-klmnopqrstuv", "CreationDate": 1686000000.0, "Enabled": true, "Description": "Example key for encrypting app data", "KeyUsage": "ENCRYPT_DECRYPT", "KeyState": "Enabled", "Origin": "AWS_KMS" } }
→
--description - Adds a human-readable description to the key
→
--tags - Adds metadata tags to help organize keys
This command lists all the KMS keys in your AWS account so you can see the keys you have created.
Terminal
aws kms list-keys
Expected OutputExpected
{ "Keys": [ { "KeyId": "abcd1234-5678-90ef-ghij-klmnopqrstuv", "KeyArn": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-5678-90ef-ghij-klmnopqrstuv" } ] }
This command encrypts the text "Hello World" using the specified KMS key and saves the encrypted data to a file.
Terminal
aws kms encrypt --key-id abcd1234-5678-90ef-ghij-klmnopqrstuv --plaintext "Hello World" --output text --query CiphertextBlob | base64 --decode > encrypted.dat
Expected OutputExpected
No output (command runs silently)
→
--key-id - Specifies which key to use for encryption
→
--plaintext - The data to encrypt
This command decrypts the encrypted data file back to the original plaintext using the KMS key.
Terminal
aws kms decrypt --ciphertext-blob fileb://encrypted.dat --output text --query Plaintext | base64 --decode
Expected OutputExpected
Hello World
→
--ciphertext-blob - Specifies the encrypted data file to decrypt
Key Concept

If you remember nothing else, remember: AWS KMS lets you safely create, use, and control encryption keys without handling the raw keys yourself.

Common Mistakes
Using the wrong key ID when encrypting or decrypting data
The command will fail or produce unusable data because the key does not match.
Always copy the exact KeyId from the create or list command output and use it in encryption and decryption commands.
Not specifying the plaintext correctly in the encrypt command
The command may encrypt empty data or fail, leading to confusion.
Use the --plaintext flag with the exact string you want to encrypt, enclosed in quotes.
Forgetting to decode base64 output when encrypting or decrypting
The encrypted or decrypted data will be unreadable or corrupted if base64 encoding is not handled properly.
Use base64 decode commands as shown to convert data to and from binary safely.
Summary
Create a KMS key with a description and tags to identify its use.
List your keys to confirm the key ID for encryption and decryption.
Encrypt plaintext data using the key and save the encrypted output.
Decrypt the encrypted data back to plaintext using the same key.

Practice

(1/5)
1. What is the main purpose of AWS KMS (Key Management Service)?
easy
A. To create and manage encryption keys for data protection
B. To store large files securely
C. To monitor network traffic
D. To manage user access permissions

Solution

  1. Step 1: Understand the role of KMS

    AWS KMS is designed to create and manage cryptographic keys used to encrypt and decrypt data.

  2. Step 2: Compare with other options

    Options B, C, and D describe other AWS services or functions unrelated to key management.

  3. Final Answer:

    To create and manage encryption keys for data protection -> Option A

  4. Quick Check:

    KMS purpose = encryption key management [OK]
Hint: KMS is about keys, not files or users [OK]
Common Mistakes:
  • Confusing KMS with storage services
  • Thinking KMS manages user permissions
  • Assuming KMS monitors network traffic
2. Which of the following is the correct way to enable automatic yearly key rotation for a KMS key using AWS CLI?
easy
A. aws kms rotate-key --key-id
B. aws kms update-key --key-id --rotation on
C. aws kms set-key-rotation --key-id --enable true
D. aws kms enable-key-rotation --key-id

Solution

  1. Step 1: Recall AWS CLI command for key rotation

    The correct command to enable automatic yearly rotation is 'aws kms enable-key-rotation --key-id '.

  2. Step 2: Check other options for correctness

    Options A, C, and D are not valid AWS CLI commands for enabling key rotation.

  3. Final Answer:

    aws kms enable-key-rotation --key-id <key-id> -> Option D

  4. Quick Check:

    Enable key rotation command = aws kms enable-key-rotation --key-id [OK]
Hint: Enable key rotation uses 'enable-key-rotation' command [OK]
Common Mistakes:
  • Using incorrect command names
  • Trying to rotate keys manually with wrong syntax
  • Confusing update commands with enable commands
3. Given the following AWS KMS key policy snippet, what permission does it grant?
{
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"},
  "Action": ["kms:Encrypt", "kms:Decrypt"],
  "Resource": "*"
}
medium
A. Alice can delete the key
B. Alice can only create keys
C. Alice can encrypt and decrypt data using the key
D. Alice can manage key rotation

Solution

  1. Step 1: Analyze the policy actions

    The policy allows 'kms:Encrypt' and 'kms:Decrypt' actions for Alice, meaning she can encrypt and decrypt data with the key.

  2. Step 2: Understand what is not allowed

    There is no permission for creating, deleting, or managing key rotation in this policy snippet.

  3. Final Answer:

    Alice can encrypt and decrypt data using the key -> Option C

  4. Quick Check:

    Actions = Encrypt and Decrypt permissions [OK]
Hint: Check 'Action' field for allowed operations [OK]
Common Mistakes:
  • Assuming all permissions are granted
  • Confusing encrypt/decrypt with key management
  • Ignoring the 'Action' list details
4. You tried to delete a KMS key but received an error. What is the most likely reason?
medium
A. The key has a deletion window set and cannot be deleted immediately
B. The key is not enabled for encryption
C. The key is not attached to any resource
D. The key rotation is disabled

Solution

  1. Step 1: Understand KMS key deletion rules

    KMS keys cannot be deleted immediately; they require a waiting period called the deletion window.

  2. Step 2: Evaluate other options

    Options A, B, and D do not prevent deletion; only the deletion window does.

  3. Final Answer:

    The key has a deletion window set and cannot be deleted immediately -> Option A

  4. Quick Check:

    Deletion window blocks immediate key deletion [OK]
Hint: KMS keys delete only after waiting period [OK]
Common Mistakes:
  • Trying to delete keys instantly
  • Confusing key enablement with deletion
  • Ignoring deletion window requirement
5. You want to ensure your KMS key automatically rotates every year and cannot be deleted accidentally. Which two settings should you configure?
hard
A. Disable key rotation and set a minimum 30-day deletion window
B. Enable key rotation and set a minimum 7-day deletion window
C. Enable key rotation and disable deletion window
D. Disable key rotation and set deletion window to 0 days

Solution

  1. Step 1: Enable automatic yearly key rotation

    Enabling key rotation ensures the key updates automatically every year.

  2. Step 2: Set a deletion window to prevent accidental deletion

    A minimum 7-day deletion window is required to avoid immediate key loss and allow recovery.

  3. Final Answer:

    Enable key rotation and set a minimum 7-day deletion window -> Option B

  4. Quick Check:

    Rotation enabled + deletion window set = safe key management [OK]
Hint: Rotate keys yearly and set deletion window ≥7 days [OK]
Common Mistakes:
  • Disabling rotation when it should be enabled
  • Setting deletion window to zero
  • Disabling deletion window entirely
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard