CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS KMS & Encryption: When to Use What (and How the Exam Tests It)
Understand when to use AWS KMS for encryption, its key management options, and how the SAA-C03 exam tests your knowledge on these concepts.
AWS Key Management Service (KMS) simplifies the management of encryption keys. It manages creation, rotation, and access control. Every key usage is logged in CloudTrail. This service is crucial for maintaining security in AWS environments. But when do we actually reach for KMS? Let's break it down.
When to Use AWS KMS
Encryption at Rest: Use KMS when you need auditable and access-controlled encryption. This applies to services like Amazon S3, EBS, and RDS. For instance, if your S3 bucket holds sensitive data, leveraging Server-Side Encryption with KMS (SSE-KMS) ensures that access to the data is tightly controlled and logged.
Envelope Encryption: If your application needs to encrypt data before storing it, KMS is the right choice. Envelope encryption combines the efficiency of symmetric encryption for data and the security of asymmetric encryption for the keys. This method allows you to control the lifecycle of your encryption keys effectively.
Key Architectural Decisions
Customer Managed Keys vs. AWS Managed Keys: Choose customer managed keys when you require custom key policies, control over key rotation, and audit capabilities. In contrast, AWS managed keys offer simplicity and ease of use when advanced control is not necessary.
Data Classification and Tenant Separation: Separate keys based on data classification or tenant. This practice helps in controlling the blast radius, ensuring that if one key is compromised, it does not affect all data.
Encryption in Transit: Remember that encryption in transit is a different consideration. Always enforce Transport Layer Security (TLS) through policies. KMS is focused on encryption at rest and key management.
Gotchas & Exam Traps
Be aware of common pitfalls when it comes to KMS and encryption on the exam:
- If a question states “auditable, rotatable keys with usage logged,” the answer is SSE-KMS with a customer managed key. Do not confuse this with SSE-S3, which lacks those features.
- KMS can experience request throttling under heavy workloads. Design your architecture to handle this scenario, especially in high-demand applications.
- If you need secrets that must rotate automatically, consider using AWS Secrets Manager instead of relying solely on KMS.
How the Exam Tests This
The SAA-C03 exam often tests your knowledge on KMS and encryption through specific patterns:
- Scenario-Based Questions: Expect scenarios where you must determine the best encryption strategy based on requirements for auditability and access control.
- Key Management Options: Questions may ask you to compare customer managed keys and AWS managed keys based on given requirements.
- Misleading Options: Be prepared for options that seem correct but overlook key features like automatic rotation or logging capabilities.
The Rule to Remember
Default to encrypting everything; KMS makes encryption, auditing, and access control straightforward.
For more practice, check out our free mock exam to test your knowledge further: Take the free SAA-C03 mock exam.