Encrypt Data with AWS KMS
In this instructional, we’ll go over the basics of AWS Key Management Service (KMS).
KMS is a managed service that allows you to easily create and control cryptographic keys that are used to encrypt and sign your data among other AWS services.
We’ll be following this guide by NextWork.
WHAT WE’LL BE DOING
We will be:
- Creating encryption keys with AWS KMS.
- Encrypting a DynamoDB database with a KMS key.
- Adding and retrieving data from your database to test the encryption.
- Confirming how AWS stops unauthorised access to your data.
- Giving a separate user encryption access.
- Create a KMS Key
- Create and encrypt a DynamoDB table
- Add data to the table
- Create a test user
- Validate the KMS encryption
- Give your test user access
- Delete your resources.
CREATE A KMS KEY
We’ll create the KMS key by going to the ‘Key Management Service’ console:
Choose ‘Symmetric’ and ‘Encrypt and decrypt’.
Alias: “medium-[your-name]-key”
Description: “The KMS key will encrypt a DynamoDB database.”
Select your IAM user as the key administrator of your KMS key:
A key administrator is someone who controls both the access and the use of encryption keys. A key administrator has control over the key’s lifecycle and it’s policies, even if they don’t use the key themselves.
Continue:
You should now have a confirmation:
CREATE AND ENCRYPT A DYNAMODB TABLE
Since the encryption key is now created, we’ll use it on a DynamoDB table.
Applying this key will ensure that the data is encrypted at rest (as opposed to ‘in transit’ and ‘in use’).
What is DynamoDB?
DynamoDB is a fully managed, serverless NoSQL database service.
Go to the DynamoDB console and select Create table:
Table name: “medium-[your-name]-table”
Partition key: “id”
Table settings: “Default settings”
Click on Create table.
The table is now created:
Now let’s encrypt the table.
Get Lumenyx’s stories in your inbox
Join Medium for free to get updates from this writer.
Click on the hyperlink for your table, scroll down to Encryption and select Manage encryption:
Select ‘Customer managed key’ and select the KMS key we created earlier.
What’s a customer managed key?
A customer managed key is a key that you create, own, and manage within your AWS account, giving you full control over its lifecycle, rotation schedule, and the specific policies that determine who has authorisation over it.
ADD DATA TO THE TABLE
We’ll now add data to the table and then confirm if the encryption works.
Go back to the medium-lumenyx-table table, click on Actions, and choose Create item:
What’s an item?
An item is a single data record in a table.
Make the value ‘1’ then choose Create item:
We can now see the entry in our table:
CREATE A TEST USER
Now we’ll create a test user who will not have access to the KMS key, and see if it can view the contents of the table.
If you don’t know how to create an IAM User, I made a quick guide here.
Once the new IAM user account is created, add them to the AmazonDynamoDBFullAccess policy:
VALIDATE KMS ENCRYPTION
From your new account, go to:
DynamoDB > Explore items > medium-lumenyx-table
You will notice that you do not have the permission to view this content:
The content is encrypted with a specific key, and the new user does not have the permissions to utilise this key.
GIVING THE TEST USER ACCESS
We’ll now give the test user, Max.Power, ‘Key user’ access to this KMS key.
We’ll then verify that the test user can decrypt the data.
With your IAM Administrator account, navigate to this path:
KMS > Customer managed keys > [your KMS key]
Under Key users click on Add then add the test user account:
From the new user’s perspective, refresh the DynamboDB page and you can now see that you can now view the information in the table:
DELETE YOUR RESOURCES — SO YOU DON’T GET CHARGED
DELETE THE DYNAMODB TABLE:
DynamoDB > Tables
SCHEDULE THE KMS KEY DELETION:
KMS > Customer managed keys
Schedule the key deletion for 7 days. The 7 day minimum serves as a mandatory safety period to ensure you have sufficient time to restore the key should you determine it is still necessary for data access.
DELETE THE IAM USER:
All done!
