‫So let's have a look at the KMS service.
‫And first on the left side
‫I will look at the AWS managed keys.
‫You can see
‫if I've been using KMS encryption throughout this course
‫then these keys will appear right here.
‫So we can look for example, at the AWS EBS.
‫And this is an S managed key
‫because it belongs to the EBS service.
‫So we can have a look here how it's being used.
‫So there is a key policy
‫and this policy defines what can access this key.
‫And of course, because this is an EBS AWS key
‫then you will look at all the actions.
‫So it can come from anywhere, do some kind of actions.
‫But the condition is that the color accounts has to be mine.
‫And the VS service has to be the EC two service
‫which is a service above the EBS service.
‫Okay?
‫If I looked for example
‫at another AWS managed key, for example, the SQS one
‫and look at the key policy here, the via service
‫as a condition to my KMS key policy is the SQS service.
‫Therefore allowing only access from, to KMS
‫from SQS to this key
‫we can also look at the cryptographic configuration
‫which shows that this key is symmetric of origin KMS
‫and it's used to encrypt N decrypt data.
‫Okay.
‫So that's for the KMS managed key by AWS
‫but then we have other accounts.
‫We have the customer managed keys as well
‫as the customer key store.
‫So the customer key store is when we wanna use CloudHSM
‫but this is out of scope for this exam.
‫So we don't go over this.
‫We're just gonna go over the customer manage key.
‫So this is when we want to create our own keys
‫within KMS and not use the ones managed by AWS.
‫So let's create a key, but if we do so
‫remember this gonna cost you $1 per month.
‫So if you don't wanna pay anything, then do not do this.
‫So here for the key type, have multiple options
‫have the symmetric or asymmetric type of key.
‫So if I use asymmetric, this could be used for encrypt
‫and decrypt or sign and verify type of operations
‫but this is out of scope for this lecture.
‫I am going to use the symmetric type of KMS key
‫and we'll use the encrypt and decrypt option.
‫Okay, this is the most basic one.
‫I want to show you,
‫for advanced options.
‫The key origin is going to be KMS
‫because we want KMS to create this key for us.
‫If we wanted to import a key, this will be the external type
‫of key origin or custom key story.
‫If you wanted to have CloudHSM.
‫But again, this is out of scope.
‫So we'll use KMS and here for regionality
‫we have single region key and multi region key
‫and we're just going to consider single region
‫key right now, because this is the most
‫the oldest type of option and the most common for KMS.
‫So we'll use single region key, click on next,
‫next we have a key alias
‫so I'll just have it as tutorial, click on next.
‫And here we can start define key administrators.
‫So if I don't define one, then we're going to
‫use the default KMS key policy, which is what I want.
‫But if you wanted to be very specific
‫about who can use this key and who could administer it
‫this is where it would happen.
‫So right now I'm not going to take anything
‫and click on next.
‫Then you can say, who can use this key?
‫So again, this is
‫for your KMS key policy to be more specific right now.
‫I want to allow everyone to use it
‫if they have the right IAM permissions.
‫But if you wanted to also have some extra security
‫you could say, Hey, only Stephan can use this key.
‫And this would create a custom KMS key policy.
‫But in this instance, I don't want this.
‫And as you can see at the bottom
‫I can choose other AWS accounts to access my key.
‫So this is if you had, for example
‫the use case of sharing an encrypted snapshot
‫an EBS snapshot, for example
‫you would add another account to allow access to your key.
‫So we summarize everything.
‫So we have a symmetric key, and then this is the key policy
‫and this is what I call the default key policy.
‫This is just to enable IAM user permission.
‫So it allows anything to do any resource on KMS, as long
‫as they will have of course, IAM permissions to do so.
‫So let's finish this.
‫And now my key has been created
‫and we can click on view key.
‫So now that my key is created
‫I can have a look at the key policy.
‫And so the key policy is just like this.
‫It's an IAM policy for your key, but you can switch
‫to the default view and you can see in a better summary
‫like who are the key administrators?
‫Is it allowed for key deletion, who are the key users
‫and can other accounts access it?
‫So I won't touch this.
‫Then you can have a look at the cryptographic configuration.
‫I won't touch this, tags not needed.
‫Key rotation is very important.
‫So if we do want to enable key rotation
‫we have to tick this box
‫and this would rotate this KMS key every year.
‫Okay, you cannot configure it to be more or less.
‫It has to happen every year.
‫And it's only possible because I did create this
‫key from within KMS.
‫And finally see, finally, what is the alias for my key?
‫It is named tutorial.
‫So I can refer to it with an alias
‫which can be a little bit simpler for us.
‫Finally, for key actions
‫you can disable it or schedule key deletion.
‫So we have our key.
‫It's great, but now let's go use the CLI to
‫encrypt and decrypt some data.
‫So under KMS, I have KMS demo CLI dot SH, which is going to
‫show us how to use the encrypt and crypto of KMS
‫with an example.
‫So first we are gonna to create a file
‫and I'm going to call it example, secret file dot TXT.
‫And with it, I'm going to say there
‫is a super secret password, okay?
‫So this is whatever you want in this text file,
‫for me, I just entered a password called super secret
‫password, and we're going to encrypt it and then decrypt it
‫using KMS.
‫So the first thing that you
‫do for KMS encryption is use the encrypt command.
‫So we have to specify a key ID for me
‫it's alias slash tutorial.
‫So this corresponds to the key I have created in my console.
‫And you could use the alias.
‫You could use this key ID right here
‫or you could use the full ARN.
‫It doesn't really matter, just use whatever you want.
‫And then you need to pass
‫in plain text the address of your file.
‫So for me it's example secret file dot txt,
‫the output of the query.
‫So you're querying for a cipher text blog
‫which represents the encrypted contents.
‫And you want the text as is
‫and finally the region, your key is in.
‫So for me, my nearest region EU west two.
‫This is going to give us a base 64 file
‫containing the encrypted content.
‫So let's copy this command right here and paste it, run it.
‫And now I have a file called example
‫secret file encrypted at base 64.
‫And this represents my encrypted file.
‫Okay?
‫In base 64.
‫So just with letters and numbers that we can recognize now
‫though, we're going to do a base 64 decode to
‫get the binary encrypted value.
‫So if you're on Windows, the command is different.
‫So for Linux, I'm just going to run this one
‫but for Windows, you can run the other one.
‫And so the idea is
‫that you're going to create a file called example
‫secret file encrypted without a base 64.
‫So let me copy this and paste it.
‫And now I have a new file called example
‫secret file encrypted.
‫And if I try to open it with my text editor
‫it's not going to work because it's
‫it uses either binary or unsupported, text encoding.
‫So this is indeed a binary file.
‫So this is the kind
‫of secret file that you would share with someone.
‫And so now I want to go and decrypt it.
‫So this is completely gibberish
‫and we cannot get any information of it.
‫Even this one, we cannot get any information.
‫How do we know it's super secret password?
‫So this is an encrypted file, but now we want
‫to take this encrypted binary file and decrypt it.
‫So for this, we're going to run and KMS decrypt command.
‫So this time we pass in the blog, the
‫the file that was encrypted.
‫So this is where we're passing the file in here.
‫Then we query for the plain text value.
‫So the decrypted value
‫and we write this to another file that is going
‫to be base 64 encrypted, and we specify the region.
‫So let's go ahead.
‫KMS knows automatically which key to use for
‫the description
‫because it is included in the blob of encrypted value.
‫So let me enter this.
‫And so this has succeeded.
‫So now if I go to my example
‫file decrypted base 64, it is here.
‫It's a much shorter thing.
‫And now we're going to basic 64
‫decode this to get my text value.
‫So we'll have a different command again
‫if you're on Windows or if you're on Max, I'm on Mac
‫I'm going to use this one.
‫So I'm copying this command, pasting it.
‫And now we have done a base 64 decoding of our file.
‫So if we go back to example, file decrypted dot TXT
‫we find back our super secret password.
‫So we have shown the encryption and its reverse operation.
‫The decryption.
‫Obviously these are low level commands.
‫The SDK will abstract some of that for us
‫but this shows you the full example
‫of how you can use the encrypt and decrypt command
‫of KMS with your own customer master key.
‫So that's it super simple.
‫I hope that was helpful.
‫And I will see you in the next lecture.