AWS KMS for beginners: key types, CloudHSM and EBS encryption
AWS Key Management Service (AWS KMS) is a managed service for creating and controlling the keys that encrypt your data, and the keys never leave it unencrypted. Its keys come in three types: customer managed keys you fully control, AWS managed keys a service creates in your account, and AWS owned keys that live outside your account. AWS CloudHSM is the choice when you need single-tenant hardware security modules under your own control.
What AWS KMS does
AWS KMS creates and controls the keys used to encrypt and sign your data. KMS keys are protected by FIPS 140-3 Security Level 3 validated hardware security modules and never leave AWS KMS unencrypted.
Many AWS services use KMS keys to encrypt the data they store for you. Key policies in KMS decide who can use each key.
Three types of KMS key
Customer managed keys are keys you create, own and manage in your account. You control their key policies, rotation and deletion, and you can audit their use in AWS CloudTrail. They have a monthly fee plus a usage fee.
AWS managed keys are created in your account by an AWS service to use for you. Their aliases look like aws/ebs or aws/s3. You can view them and audit their use in CloudTrail, but you cannot change them, and AWS rotates them every year. There is no monthly fee, though usage can be charged.
AWS owned keys belong to an AWS service and are not in your account. They have no fees, but you cannot view their policies or audit their use. AWS says to use customer managed keys when control matters and AWS owned keys when convenience matters most.
CloudHSM and EBS encryption
AWS CloudHSM gives you single-tenant hardware security modules in the AWS Cloud with full control of the keys and algorithms you use. Its data plane is end-to-end encrypted and not visible to AWS, so you take on more responsibility than with a managed service. AWS suggests KMS if you want managed key control without operating your own HSMs.
Amazon EBS encryption uses KMS keys to encrypt EBS volumes and snapshots. It protects data at rest and data moving between an EC2 instance and its attached EBS volume.
You cannot remove encryption from an encrypted EBS volume or snapshot. A volume restored from an encrypted snapshot is always encrypted. To encrypt an unencrypted volume, snapshot it and create a new encrypted volume from the snapshot.
Where the exam catches people
Believing AWS owned keys can be audited in your CloudTrail logs: they are not in your account and their activity is not viewable by you; AWS managed keys can be audited.
Believing AWS managed keys carry a monthly fee: they have no monthly fee; customer managed keys do.
Believing you can change the rotation or policy of an AWS managed key: you can view and audit it, but AWS manages it and rotates it yearly.
Believing AWS KMS gives you single-tenant HSMs: that is AWS CloudHSM; KMS is a managed service that runs the HSMs for you.
Believing a volume restored from an encrypted EBS snapshot can be unencrypted: encryption cannot be removed, so it is always encrypted.