What is AWS KMS and how does encryption work in AWS?
Learn how AWS KMS manages encryption keys using envelope encryption, key policies, and CloudTrail auditing to protect data at rest and in transit.
Expected Interview Answer
AWS KMS (Key Management Service) is a managed service that creates and controls the encryption keys used to protect your data, integrating with most AWS services to encrypt data at rest and in transit.
KMS uses envelope encryption: a customer master key (KMS key) never leaves the service and is used to encrypt short-lived data keys, which in turn encrypt your actual data. Services like S3, EBS, and RDS request a data key, use it, and store only the encrypted form. Access to keys is governed by key policies and IAM, and every use is logged to CloudTrail for auditing.
- Centralized key management and rotation
- Envelope encryption so master keys never leave KMS
- Fine-grained access control via key policies and IAM
- Full audit trail through CloudTrail
- Native integration with S3, EBS, RDS, and more
- FIPS 140-2 validated hardware security modules
AI Mentor Explanation
Think of a stadium's master trophy vault whose only key stays locked inside the room forever. To hand out daily lockers to players, the vault issues single-use spare keys, uses them, then shreds them. The master never leaves, yet every locker is secured — exactly how KMS keeps its key internal while issuing throwaway data keys.
Step-by-Step Explanation
Step 1
Create a KMS key
Provision a symmetric KMS key and attach a key policy defining who can administer and use it.
Step 2
Request a data key
A service like S3 calls GenerateDataKey to receive a plaintext data key plus its KMS-encrypted copy.
Step 3
Encrypt the data
The plaintext data key encrypts your object locally, then the plaintext copy is discarded from memory.
Step 4
Store the encrypted data key
The encrypted data key is stored alongside the ciphertext so it can be decrypted later.
Step 5
Decrypt on read
On access, KMS decrypts the stored data key (enforcing policy), and that key decrypts the object.
What Interviewer Expects
- Understanding of envelope encryption
- Difference between KMS keys and data keys
- How key policies and IAM control access
- Encryption at rest vs in transit
- CloudTrail auditing of key usage
Common Mistakes
- Thinking the master key encrypts large data directly
- Confusing KMS keys with data keys
- Ignoring key policies and relying on IAM alone
- Assuming keys can be exported out of KMS
- Forgetting to enable automatic key rotation
Best Answer (HR Friendly)
“AWS KMS is a service that safely creates and manages the digital keys used to lock and unlock your data. It uses a layered approach where a protected master key generates temporary keys that do the actual encryption, and every use is logged for security auditing.”
Code Example
# Create a customer managed KMS key
aws kms create-key --description "App data encryption key"
# Encrypt a small secret using the key
aws kms encrypt \
--key-id alias/app-data \
--plaintext fileb://secret.txt \
--output text --query CiphertextBlob | base64 --decode > secret.enc
# Enable automatic yearly rotation
aws kms enable-key-rotation --key-id alias/app-dataFollow-up Questions
- What is the difference between an AWS managed key and a customer managed key?
- How does automatic key rotation work in KMS?
- What is a KMS grant and when would you use one?
- How do key policies interact with IAM policies?
MCQ Practice
1. In envelope encryption, what does the KMS key directly encrypt?
The KMS master key encrypts the short-lived data key, which then encrypts the actual data.
2. Where is a customer managed KMS key's key material stored?
KMS key material never leaves the service; only data keys are handed out and used externally.
Flash Cards
What is envelope encryption? — Encrypting data with a data key, then encrypting that data key with a KMS master key.
Where do KMS master keys live? — Inside KMS on FIPS 140-2 validated HSMs; they never leave the service.
How is KMS usage audited? — Every key operation is logged to AWS CloudTrail.
What controls access to a KMS key? — Key policies combined with IAM policies and optional grants.