KMS for key management in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a new KMS key using AWS CLI.

AWS

aws kms create-key --description [1]

Drag options to blanks, or click blank then click option'

A"alias/mykey"

B--key-id

C"My KMS key"

D--region us-east-1

Attempts:

3 left

💡 Hint

Common Mistakes

Using --key-id instead of --description

Not enclosing the description in quotes

Using alias instead of description

The --description parameter requires a string describing the key.

2fill in blank

medium

Complete the code to create an alias for an existing KMS key.

AWS

aws kms create-alias --alias-name [1] --target-key-id 1234abcd-12ab-34cd-56ef-1234567890ab

Drag options to blanks, or click blank then click option'

A"key/myKeyAlias"

B"myKeyAlias"

C"alias/1234abcd"

D"alias/myKeyAlias"

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting 'alias/' prefix

Using 'key/' prefix instead

Not quoting the alias name

Alias names must start with 'alias/' followed by the alias name.

3fill in blank

hard

Fix the error in the command to enable key rotation for a KMS key.

AWS

aws kms [1]-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

Drag options to blanks, or click blank then click option'

Aenable

Bcreate

Cdisable

Dupdate

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'create-key-rotation' which is invalid

Using 'update-key-rotation' which is invalid

Using 'disable-key-rotation' instead of 'enable-key-rotation'

The correct command to enable key rotation is 'enable-key-rotation'.

4fill in blank

hard

Fill both blanks to list all KMS keys in a specific region.

AWS

aws kms [1]-keys --region [2]

Drag options to blanks, or click blank then click option'

Alist

Bus-west-2

Cdescribe

Deu-central-1

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'describe-keys' which is invalid

Omitting the region or using wrong region code

Using 'list' without '-keys'

The command 'list-keys' lists all keys; region specifies the AWS region.

5fill in blank

hard

Fill all three blanks to create a KMS key with a policy that allows encryption.

AWS

aws kms create-key --policy '{{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": [1], "Action": [2], "Resource": [3]] }}'

Drag options to blanks, or click blank then click option'

A{"AWS": "arn:aws:iam::123456789012:user/Alice"}

B["kms:Encrypt"]

C"*"

D{"AWS": "arn:aws:iam::123456789012:root"}

Attempts:

3 left

💡 Hint

Common Mistakes

Using root ARN instead of specific user

Not using a list for Action

Using a specific resource ARN instead of '*'

The policy principal is a specific user, action is kms:Encrypt in a list, and resource is '*' for all resources.

Practice

1. What is the main purpose of AWS KMS (Key Management Service)?

easy

A. To create and manage encryption keys for data protection

B. To store large files securely

C. To monitor network traffic

D. To manage user access permissions

Solution

1. Step 1: Understand the role of KMS

   AWS KMS is designed to create and manage cryptographic keys used to encrypt and decrypt data.

2. Step 2: Compare with other options

   Options B, C, and D describe other AWS services or functions unrelated to key management.

3. Final Answer:

   To create and manage encryption keys for data protection -> Option A

4. Quick Check:

   KMS purpose = encryption key management [OK]

Hint: KMS is about keys, not files or users [OK]

Common Mistakes:

• Confusing KMS with storage services
• Thinking KMS manages user permissions
• Assuming KMS monitors network traffic

2. Which of the following is the correct way to enable automatic yearly key rotation for a KMS key using AWS CLI?

easy

A. aws kms rotate-key --key-id

B. aws kms update-key --key-id --rotation on

C. aws kms set-key-rotation --key-id --enable true

D. aws kms enable-key-rotation --key-id

Solution

1. Step 1: Recall AWS CLI command for key rotation

   The correct command to enable automatic yearly rotation is 'aws kms enable-key-rotation --key-id '.

2. Step 2: Check other options for correctness

   Options A, C, and D are not valid AWS CLI commands for enabling key rotation.

3. Final Answer:

   aws kms enable-key-rotation --key-id <key-id> -> Option D

4. Quick Check:

   Enable key rotation command = aws kms enable-key-rotation --key-id [OK]

Hint: Enable key rotation uses 'enable-key-rotation' command [OK]

Common Mistakes:

• Using incorrect command names
• Trying to rotate keys manually with wrong syntax
• Confusing update commands with enable commands

3. Given the following AWS KMS key policy snippet, what permission does it grant?

{
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"},
  "Action": ["kms:Encrypt", "kms:Decrypt"],
  "Resource": "*"
}

medium

A. Alice can delete the key

B. Alice can only create keys

C. Alice can encrypt and decrypt data using the key

D. Alice can manage key rotation

Solution

1. Step 1: Analyze the policy actions

   The policy allows 'kms:Encrypt' and 'kms:Decrypt' actions for Alice, meaning she can encrypt and decrypt data with the key.

2. Step 2: Understand what is not allowed

   There is no permission for creating, deleting, or managing key rotation in this policy snippet.

3. Final Answer:

   Alice can encrypt and decrypt data using the key -> Option C

4. Quick Check:

   Actions = Encrypt and Decrypt permissions [OK]

Hint: Check 'Action' field for allowed operations [OK]

Common Mistakes:

• Assuming all permissions are granted
• Confusing encrypt/decrypt with key management
• Ignoring the 'Action' list details

4. You tried to delete a KMS key but received an error. What is the most likely reason?

medium

A. The key has a deletion window set and cannot be deleted immediately

B. The key is not enabled for encryption

C. The key is not attached to any resource

D. The key rotation is disabled

Solution

1. Step 1: Understand KMS key deletion rules

   KMS keys cannot be deleted immediately; they require a waiting period called the deletion window.

2. Step 2: Evaluate other options

   Options A, B, and D do not prevent deletion; only the deletion window does.

3. Final Answer:

   The key has a deletion window set and cannot be deleted immediately -> Option A

4. Quick Check:

   Deletion window blocks immediate key deletion [OK]

Hint: KMS keys delete only after waiting period [OK]

Common Mistakes:

• Trying to delete keys instantly
• Confusing key enablement with deletion
• Ignoring deletion window requirement

5. You want to ensure your KMS key automatically rotates every year and cannot be deleted accidentally. Which two settings should you configure?

hard

A. Disable key rotation and set a minimum 30-day deletion window

B. Enable key rotation and set a minimum 7-day deletion window

C. Enable key rotation and disable deletion window

D. Disable key rotation and set deletion window to 0 days

Solution

1. Step 1: Enable automatic yearly key rotation

   Enabling key rotation ensures the key updates automatically every year.

2. Step 2: Set a deletion window to prevent accidental deletion

   A minimum 7-day deletion window is required to avoid immediate key loss and allow recovery.

3. Final Answer:

   Enable key rotation and set a minimum 7-day deletion window -> Option B

4. Quick Check:

   Rotation enabled + deletion window set = safe key management [OK]

Hint: Rotate keys yearly and set deletion window ≥7 days [OK]

Common Mistakes:

• Disabling rotation when it should be enabled
• Setting deletion window to zero
• Disabling deletion window entirely