Understanding KMS keys

KMS is a managed service from Amazon that makes it easy to produce and manage Customer-Managed Keys (CMKs). CMKs are the encryption keys used to secure and control access data stored on AWS. KMS integrates seamlessly with many other services, especially the IAM service, so that you can control who is allowed access to the keys.

AWS creates the key material for the KMS key. You, as the customer, cannot extract, export, view, or manage this key material. You can delete the key but cannot delete the key material itself:

Figure 19.2 – Master and data keys in AWS KMS

One of the key concepts to understand in KMS is envelope encryption. When AWS encrypts your data, your data is secured, but your key needs to be protected as well. AWS does this by encrypting your data with a data key and then encrypting the data key with another key. That top-level plaintext key is known as the master key.

Using the envelope encryption process...