KMS for key management in AWS - Step-by-Step Execution

Process Flow - KMS for key management

Create KMS Key

↓

Define Key Policy

↓

Use Key to Encrypt Data

↓

Store Encrypted Data

↓

Request Decrypt with Key

↓

KMS Checks Permissions

↓

Decrypt Data

↓

Return Plain Data

This flow shows how a KMS key is created, used to encrypt data, and then used to decrypt data with permission checks.

Execution Sample

AWS

1. Create KMS key with policy
2. Encrypt data using key
3. Store encrypted data
4. Request decrypt
5. KMS checks permissions
6. Return decrypted data if allowed

This sequence shows how AWS KMS manages keys to encrypt and decrypt data securely.

Process Table

Step	Action	Input	KMS Response	Result
1	Create KMS Key	Key policy with permissions	Key created with ID	Key ready for use
2	Encrypt Data	Plain data + Key ID	Data encrypted	Encrypted data stored
3	Store Data	Encrypted data	Data stored securely	Data saved in storage
4	Request Decrypt	Encrypted data + User credentials	Permission check started	Waiting for permission result
5	Check Permissions	User credentials + Key policy	Permission granted	Proceed to decrypt
6	Decrypt Data	Encrypted data + Key	Data decrypted	Plain data returned
7	Request Decrypt	Encrypted data + User credentials	Permission check started	Waiting for permission result
8	Check Permissions	User credentials + Key policy	Permission denied	Access denied, no decryption
9	End	N/A	N/A	Process stops due to denied permission

💡 Execution stops when permission is denied or data is decrypted and returned.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	After Step 6	After Step 8	Final
KMS Key	None	Created with ID	Exists	Exists	Exists	Exists	Exists
Encrypted Data	None	None	Created	Exists	Exists	Exists	Exists
User Permission	Unknown	Unknown	Unknown	Checked	Granted	Denied	Denied or Granted
Decrypted Data	None	None	None	None	Returned	None	Returned or None

Key Moments - 3 Insights

Why does decryption fail even if the encrypted data is correct?

Decryption fails if the user does not have permission according to the key policy, as shown in execution_table rows 7-9 where permission is denied.

What happens if the key policy is too restrictive?

If the key policy denies access, no user can decrypt data, stopping the process at permission check (rows 7-9). This ensures security but can block legitimate access.

Is the encrypted data stored in plain text anywhere?

No, encrypted data is stored securely (row 3), and only decrypted data is returned after permission checks (row 6).

Visual Quiz - 3 Questions

Look at the execution_table, what is the KMS response at step 2?

A Key created

B Permission denied

C Data encrypted

D Data decrypted

💡 Hint

Check the 'KMS Response' column at step 2 in the execution_table.

At which step does the permission check deny access?

A Step 8

B Step 5

C Step 6

D Step 3

💡 Hint

Look for 'Permission denied' in the 'KMS Response' column in the execution_table.

If the key policy allowed all users, how would the variable 'User Permission' change after step 4?

A It would be 'Denied'

B It would be 'Granted'

C It would be 'Unknown'

D It would be 'None'

💡 Hint

Refer to variable_tracker for 'User Permission' values after step 4.

Concept Snapshot

AWS KMS manages encryption keys securely.
Create a key with a policy defining who can use it.
Encrypt data using the key.
Decrypt requests check permissions first.
If allowed, data is decrypted and returned.
If denied, access is blocked.

Full Transcript

This visual execution shows how AWS KMS handles key management. First, a KMS key is created with a policy that controls access. Data is encrypted using this key and stored securely. When a user requests to decrypt data, KMS checks the user's permissions against the key policy. If permission is granted, KMS decrypts the data and returns it. If permission is denied, KMS blocks access and does not decrypt the data. This ensures data security by controlling who can use the encryption keys.

Practice

1. What is the main purpose of AWS KMS (Key Management Service)?

easy

A. To create and manage encryption keys for data protection

B. To store large files securely

C. To monitor network traffic

D. To manage user access permissions

Solution

1. Step 1: Understand the role of KMS

   AWS KMS is designed to create and manage cryptographic keys used to encrypt and decrypt data.

2. Step 2: Compare with other options

   Options B, C, and D describe other AWS services or functions unrelated to key management.

3. Final Answer:

   To create and manage encryption keys for data protection -> Option A

4. Quick Check:

   KMS purpose = encryption key management [OK]

Hint: KMS is about keys, not files or users [OK]

Common Mistakes:

• Confusing KMS with storage services
• Thinking KMS manages user permissions
• Assuming KMS monitors network traffic

2. Which of the following is the correct way to enable automatic yearly key rotation for a KMS key using AWS CLI?

easy

A. aws kms rotate-key --key-id

B. aws kms update-key --key-id --rotation on

C. aws kms set-key-rotation --key-id --enable true

D. aws kms enable-key-rotation --key-id

Solution

1. Step 1: Recall AWS CLI command for key rotation

   The correct command to enable automatic yearly rotation is 'aws kms enable-key-rotation --key-id '.

2. Step 2: Check other options for correctness

   Options A, C, and D are not valid AWS CLI commands for enabling key rotation.

3. Final Answer:

   aws kms enable-key-rotation --key-id <key-id> -> Option D

4. Quick Check:

   Enable key rotation command = aws kms enable-key-rotation --key-id [OK]

Hint: Enable key rotation uses 'enable-key-rotation' command [OK]

Common Mistakes:

• Using incorrect command names
• Trying to rotate keys manually with wrong syntax
• Confusing update commands with enable commands

3. Given the following AWS KMS key policy snippet, what permission does it grant?

{
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"},
  "Action": ["kms:Encrypt", "kms:Decrypt"],
  "Resource": "*"
}

medium

A. Alice can delete the key

B. Alice can only create keys

C. Alice can encrypt and decrypt data using the key

D. Alice can manage key rotation

Solution

1. Step 1: Analyze the policy actions

   The policy allows 'kms:Encrypt' and 'kms:Decrypt' actions for Alice, meaning she can encrypt and decrypt data with the key.

2. Step 2: Understand what is not allowed

   There is no permission for creating, deleting, or managing key rotation in this policy snippet.

3. Final Answer:

   Alice can encrypt and decrypt data using the key -> Option C

4. Quick Check:

   Actions = Encrypt and Decrypt permissions [OK]

Hint: Check 'Action' field for allowed operations [OK]

Common Mistakes:

• Assuming all permissions are granted
• Confusing encrypt/decrypt with key management
• Ignoring the 'Action' list details

4. You tried to delete a KMS key but received an error. What is the most likely reason?

medium

A. The key has a deletion window set and cannot be deleted immediately

B. The key is not enabled for encryption

C. The key is not attached to any resource

D. The key rotation is disabled

Solution

1. Step 1: Understand KMS key deletion rules

   KMS keys cannot be deleted immediately; they require a waiting period called the deletion window.

2. Step 2: Evaluate other options

   Options A, B, and D do not prevent deletion; only the deletion window does.

3. Final Answer:

   The key has a deletion window set and cannot be deleted immediately -> Option A

4. Quick Check:

   Deletion window blocks immediate key deletion [OK]

Hint: KMS keys delete only after waiting period [OK]

Common Mistakes:

• Trying to delete keys instantly
• Confusing key enablement with deletion
• Ignoring deletion window requirement

5. You want to ensure your KMS key automatically rotates every year and cannot be deleted accidentally. Which two settings should you configure?

hard

A. Disable key rotation and set a minimum 30-day deletion window

B. Enable key rotation and set a minimum 7-day deletion window

C. Enable key rotation and disable deletion window

D. Disable key rotation and set deletion window to 0 days

Solution

1. Step 1: Enable automatic yearly key rotation

   Enabling key rotation ensures the key updates automatically every year.

2. Step 2: Set a deletion window to prevent accidental deletion

   A minimum 7-day deletion window is required to avoid immediate key loss and allow recovery.

3. Final Answer:

   Enable key rotation and set a minimum 7-day deletion window -> Option B

4. Quick Check:

   Rotation enabled + deletion window set = safe key management [OK]

Hint: Rotate keys yearly and set deletion window ≥7 days [OK]

Common Mistakes:

• Disabling rotation when it should be enabled
• Setting deletion window to zero
• Disabling deletion window entirely