From 0f5e8545eb940ff193247f16e148479db8c5d920 Mon Sep 17 00:00:00 2001 From: Noah Zoschke Date: Tue, 15 Nov 2016 19:24:59 -0800 Subject: [PATCH] KMS basics, tips, gotchas and link to tutorial blog (#307) * KMS basics, tips, gotchas and link to tutorial blog * feedback on KMS formatting and links * copy editing and remove stray line --- README.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 0305f74..2462f8a 100644 --- a/README.md +++ b/README.md @@ -1322,15 +1322,24 @@ KMS ### KMS Basics - ๐Ÿ“’ [Homepage](https://aws.amazon.com/kms/) โˆ™ [Developer guide](http://docs.aws.amazon.com/kms/latest/developerguide/) โˆ™ [FAQ](https://aws.amazon.com/kms/faqs/) โˆ™ [Pricing](https://aws.amazon.com/kms/pricing/) -- **KMS** (Key Management Service) is secure service for storing keys, such encryption keys for [EBS](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html) and [S3](http://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html). +- **KMS** (Key Management Service) is a secure service for creating, storing and auditing usage of cryptographic keys. +- **Service integration:** KMS [integrates with other AWS services](http://docs.aws.amazon.com/kms/latest/developerguide/service-integration.html): EBS, Elastic Transcoder, EMR, Redshift, RDS, SES, S3, WorkMail and Workspaces. +- **Encryption APIs:** The [Encrypt](http://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html) and [Decrypt API](http://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html) allow you to encrypt and decrypt data on the KMS service side, never exposing the master key contents. +- **Data keys:** The [GenerateDataKey](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys) API generates a new key off of a master key. The data key contents are exposed to you so you can use it to encrypt and decrypt any size of data in your application layer. KMS does not store, manage or track data keys, you are responsible for this in your application. +- ๐Ÿ”น**Auditing:** Turn on CloudTrail to audit all KMS API events. +- **Access:** Use [key policies](http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html) and [IAM policies](http://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html) to grant different levels of KMS access. For example, you create an IAM policy that only [allows a user to encrypt and decrypt with a specific key](http://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html#iam-policy-example-encrypt-decrypt-specific-cmks). ### KMS Tips - ๐Ÿ”นItโ€™s very common for companies to manage keys completely via home-grown mechanisms, but itโ€™s far preferable to use a service such as KMS from the beginning, as it encourages more secure design and improves policies and processes around managing keys. - A good motivation and overview is in [this AWS presentation](http://www.slideshare.net/AmazonWebServices/encryption-and-key-management-in-aws). - The cryptographic details are in [this AWS whitepaper](https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf). +- [This blog from Convox](https://convox.com/blog/encryption-at-rest/) demonstrates why and how to use KMS for encryption at rest. -๐Ÿšง [*Please help expand this incomplete section.*](CONTRIBUTING.md) +### KMS Gotchas and Limitations + +- ๐Ÿ”ธThe Encrypt API only works with < 4KB of data. Larger data requires generating and managing a [data key](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys) in your application layer. +- ๐Ÿ”ธKMS audit events are not available in the [CloudTrail Lookup Events API](http://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_LookupEvents.html). You need to look find them in the raw .json.gz files that CloudTrail saves in S3. CloudFront ----------