Security, Identity & Compliance
AWS KMS
Managed cryptographic keys for encryption everywhere.
Official docsOverview
Key Management Service creates and controls keys used to encrypt data across S3, EBS, RDS, Secrets Manager and more, with full audit via CloudTrail.
When to use it
- Customer-managed encryption keys
- Envelope encryption in apps
- Regulatory compliance
Setup
- Create a Customer Managed Key (symmetric AES-256).
- Define key policy + grants per principal.
- Reference by KeyId/Alias in encrypted services.
How to use
Encrypt
aws kms encrypt --key-id alias/qa --plaintext fileb://data.bin --output text --query CiphertextBlob | base64 -d > data.encQA use cases
- Verify encryption-at-rest by attempting to access raw S3 objects with wrong KMS perms — expect 403.