KMS — CMK types, envelope encryption, key rotation and grants — CI/CD, GitOps, DevSecOps & Observability

AWS Key Management Service provides cryptographic key management for data encryption across all AWS services. Encryption without key management is incomplete security: encrypting data with a key that anyone with AWS access can use provides no meaningful protection if the account is compromised. KMS enforces access to encryption keys through IAM key policies, enabling fine-grained control over who can encrypt versus decrypt data, with all key usage logged to CloudTrail for audit purposes.

Three KMS capabilities are essential for production data security: Customer Managed Keys for control over key policies and lifecycle, envelope encryption for efficiently encrypting large data volumes without sending all data through KMS, and grants for temporarily delegating key access for specific operations without modifying the key policy. Understanding how these interact defines the difference between encryption that satisfies compliance checkboxes and encryption that provides genuine security boundaries.

Analogy🏏Cricket

Think of it like cricket: Imagine the BCCI's team management system for an international tour with matches in three different countries simultaneously. Rather than a coordinator manually managing each match day's logistics, the system reads the official tour schedule document and automatically dispatches the right squad, equipment, and support staff to each venue. When the tour schedule changes—a match is rescheduled, a squad member is replaced—the system detects the change and updates the arrangements automatically. Just as the tour management system uses the official document as the source of truth and orchestrates multiple concurrent deployments to multiple venues, ArgoCD uses the Git repository as the source of truth and orchestrates multiple concurrent Application syncs to multiple clusters. Just as the system provides a dashboard showing which venues are 'ready', 'delayed', or 'degraded', ArgoCD provides a dashboard showing which Applications are Synced, OutOfSync, or Degraded. This reveals why ArgoCD is valued at scale: managing dozens of applications across multiple clusters manually is operationally equivalent to coordinating an international cricket tour by phone.