KMS encryption essentials

CMKs, key policies, and envelope encryption.

In short. AWS KMS is the managed key service behind encryption for S3, EBS, SQS, Secrets Manager, and more.

AWS KMS is the managed key service behind encryption for S3, EBS, SQS, Secrets Manager, and more. Customer managed keys (CMKs) give you key policies, rotation options, and clearer ownership than the legacy account AWS-managed defaults alone. Envelope encryption means data is encrypted with a data key; the data key is encrypted with KMS — so rotating the CMK does not require re-encrypting every byte immediately.

Key policy is as important as IAM. A CMK that trusts Principal: * with broad actions is a global decrypt button. Separate duties: admins manage keys; apps decrypt only what they need via grants or precise IAM.

Encrypt and decrypt shape

aws kms create-key --description lab-cmk --query KeyMetadata.KeyId --output text
aws kms encrypt --key-id "$KEY" --plaintext fileb://<(echo -n hello) --query CiphertextBlob --output text | head -c 40; echo …
aws kms enable-key-rotation --key-id "$KEY"

abcd-1234-…
AQICAHh…
# SUCCESS — key created, encrypt works, rotation enabled

Policy pitfalls

Confused deputy and cross-account decrypt need explicit key policy statements. CloudTrail records KMS API use — alert on unexpected Decrypt. Prefer CMKs per sensitive workload rather than one god-key for the account.

Going deeper

Automatic annual key rotation for CMKs rotates the backing key material while keeping the same key ID — applications keep working. Still plan for re-encrypt of stored data keys when your threat model requires retiring old material faster.

Grants allow temporary decrypt without rewriting key policies — useful for jobs. Expire grants. Orphaned grants accumulate like IAM users.

Multi-Region keys help DR decrypt in a second region. They change your threat model (two regions can decrypt). Use deliberately for backups you must read during regional loss.

Application-level encrypt/decrypt calls should use the AWS SDK envelope helpers or service integrations rather than inventing crypto. Home-grown AES next to KMS is a common foot-gun.

Tag keys with owner and data-class. Use those tags in IAM conditions so decrypt is limited by classification. Untagged keys become orphaned decrypt surfaces.

Separate development and production CMKs even when accounts differ — shared decrypt between environments is how staging compromises become production data leaks.

Try this

Create a lab CMK, encrypt a short string, decrypt it, then deny your principal Decrypt in the key policy and prove failure.

aws kms decrypt --ciphertext-blob fileb://ct.bin || true

An error occurred (AccessDeniedException) …

Takeaway

KMS + envelope encryption protect data at rest when key policies and IAM least-privilege decrypt are real. Encryption with a world-readable key policy is theater.

Next: S3 misconfigurations — where missing Block Public Access still causes headlines.

Related