Beginner LevelCloud Computing (AWS/GCP/Azure)
How does AWS KMS (Key Management Service) manage encryption keys for cloud services?
❓ Interview Prompt: Explain AWS KMS KMS keys, Symmetric vs Asymmetric keys, Envelope Encryption, and AWS service integrations.
AWS Key Management Service (KMS) is a managed service that makes it easy to create and control cryptographic keys used to encrypt data across AWS services and applications.
Core Concepts:
1
KMS Keys (KMSKeys): Logical keys stored inside FIPS 140-2 validated Hardware Security Modules (HSMs). Master private keys can never leave KMS HSMs.
2
Envelope Encryption:
•
KMS generates a unique Data Encryption Key (DEK).
•
The plaintext data is encrypted locally using the DEK.
•
The DEK itself is encrypted using the KMS Master Key and stored alongside the encrypted data.
•
Avoids sending massive raw data files across the network to KMS for encryption!
Code Implementation Example
typescript
import { KMSClient, GenerateDataKeyCommand } from '@aws-sdk/client-kms';
const kms = new KMSClient({});
// Executing Envelope Encryption locally using KMS Data Key
async function encryptLocally(kmsKeyId: string, plaintext: Buffer) {
// 1. Request KMS to generate a unique Data Encryption Key (DEK)
const { Plaintext: dekPlaintext, CiphertextBlob: dekEncrypted } = await kms.send(
new GenerateDataKeyCommand({ KeyId: kmsKeyId, KeySpec: 'AES_256' })
);
// 2. Encrypt large data locally using dekPlaintext (AES-256)
// ... local encryption logic ...
return { encryptedData: '...', encryptedDek: dekEncrypted };
}💡Envelope Encryption pattern generating local data encryption keys via KMS.
🎯 Interview Key Takeaway
KMS provides managed encryption keys using Envelope Encryption to protect data across S3, EBS, and RDS.
#KMS#Encryption#Security#Envelope Encryption#Beginner
Back to all Cloud Computing (AWS/GCP/Azure) Questions→