So let's have a look at the KMS service.
And first on the left side
I will look at the AWS managed keys.
You can see
if I've been using KMS encryption throughout this course
then these keys will appear right here.
So we can look for example, at the AWS EBS.
And this is an S managed key
because it belongs to the EBS service.
So we can have a look here how it's being used.
So there is a key policy
and this policy defines what can access this key.
And of course, because this is an EBS AWS key
then you will look at all the actions.
So it can come from anywhere, do some kind of actions.
But the condition is that the color accounts has to be mine.
And the VS service has to be the EC two service
which is a service above the EBS service.
Okay?
If I looked for example
at another AWS managed key, for example, the SQS one
and look at the key policy here, the via service
as a condition to my KMS key policy is the SQS service.
Therefore allowing only access from, to KMS
from SQS to this key
we can also look at the cryptographic configuration
which shows that this key is symmetric of origin KMS
and it's used to encrypt N decrypt data.
Okay.
So that's for the KMS managed key by AWS
but then we have other accounts.
We have the customer managed keys as well
as the customer key store.
So the customer key store is when we wanna use CloudHSM
but this is out of scope for this exam.
So we don't go over this.
We're just gonna go over the customer manage key.
So this is when we want to create our own keys
within KMS and not use the ones managed by AWS.
So let's create a key, but if we do so
remember this gonna cost you $1 per month.
So if you don't wanna pay anything, then do not do this.
So here for the key type, have multiple options
have the symmetric or asymmetric type of key.
So if I use asymmetric, this could be used for encrypt
and decrypt or sign and verify type of operations
but this is out of scope for this lecture.
I am going to use the symmetric type of KMS key
and we'll use the encrypt and decrypt option.
Okay, this is the most basic one.
I want to show you,
for advanced options.
The key origin is going to be KMS
because we want KMS to create this key for us.
If we wanted to import a key, this will be the external type
of key origin or custom key story.
If you wanted to have CloudHSM.
But again, this is out of scope.
So we'll use KMS and here for regionality
we have single region key and multi region key
and we're just going to consider single region
key right now, because this is the most
the oldest type of option and the most common for KMS.
So we'll use single region key, click on next,
next we have a key alias
so I'll just have it as tutorial, click on next.
And here we can start define key administrators.
So if I don't define one, then we're going to
use the default KMS key policy, which is what I want.
But if you wanted to be very specific
about who can use this key and who could administer it
this is where it would happen.
So right now I'm not going to take anything
and click on next.
Then you can say, who can use this key?
So again, this is
for your KMS key policy to be more specific right now.
I want to allow everyone to use it
if they have the right IAM permissions.
But if you wanted to also have some extra security
you could say, Hey, only Stephan can use this key.
And this would create a custom KMS key policy.
But in this instance, I don't want this.
And as you can see at the bottom
I can choose other AWS accounts to access my key.
So this is if you had, for example
the use case of sharing an encrypted snapshot
an EBS snapshot, for example
you would add another account to allow access to your key.
So we summarize everything.
So we have a symmetric key, and then this is the key policy
and this is what I call the default key policy.
This is just to enable IAM user permission.
So it allows anything to do any resource on KMS, as long
as they will have of course, IAM permissions to do so.
So let's finish this.
And now my key has been created
and we can click on view key.
So now that my key is created
I can have a look at the key policy.
And so the key policy is just like this.
It's an IAM policy for your key, but you can switch
to the default view and you can see in a better summary
like who are the key administrators?
Is it allowed for key deletion, who are the key users
and can other accounts access it?
So I won't touch this.
Then you can have a look at the cryptographic configuration.
I won't touch this, tags not needed.
Key rotation is very important.
So if we do want to enable key rotation
we have to tick this box
and this would rotate this KMS key every year.
Okay, you cannot configure it to be more or less.
It has to happen every year.
And it's only possible because I did create this
key from within KMS.
And finally see, finally, what is the alias for my key?
It is named tutorial.
So I can refer to it with an alias
which can be a little bit simpler for us.
Finally, for key actions
you can disable it or schedule key deletion.
So we have our key.
It's great, but now let's go use the CLI to
encrypt and decrypt some data.
So under KMS, I have KMS demo CLI dot SH, which is going to
show us how to use the encrypt and crypto of KMS
with an example.
So first we are gonna to create a file
and I'm going to call it example, secret file dot TXT.
And with it, I'm going to say there
is a super secret password, okay?
So this is whatever you want in this text file,
for me, I just entered a password called super secret
password, and we're going to encrypt it and then decrypt it
using KMS.
So the first thing that you
do for KMS encryption is use the encrypt command.
So we have to specify a key ID for me
it's alias slash tutorial.
So this corresponds to the key I have created in my console.
And you could use the alias.
You could use this key ID right here
or you could use the full ARN.
It doesn't really matter, just use whatever you want.
And then you need to pass
in plain text the address of your file.
So for me it's example secret file dot txt,
the output of the query.
So you're querying for a cipher text blog
which represents the encrypted contents.
And you want the text as is
and finally the region, your key is in.
So for me, my nearest region EU west two.
This is going to give us a base 64 file
containing the encrypted content.
So let's copy this command right here and paste it, run it.
And now I have a file called example
secret file encrypted at base 64.
And this represents my encrypted file.
Okay?
In base 64.
So just with letters and numbers that we can recognize now
though, we're going to do a base 64 decode to
get the binary encrypted value.
So if you're on Windows, the command is different.
So for Linux, I'm just going to run this one
but for Windows, you can run the other one.
And so the idea is
that you're going to create a file called example
secret file encrypted without a base 64.
So let me copy this and paste it.
And now I have a new file called example
secret file encrypted.
And if I try to open it with my text editor
it's not going to work because it's
it uses either binary or unsupported, text encoding.
So this is indeed a binary file.
So this is the kind
of secret file that you would share with someone.
And so now I want to go and decrypt it.
So this is completely gibberish
and we cannot get any information of it.
Even this one, we cannot get any information.
How do we know it's super secret password?
So this is an encrypted file, but now we want
to take this encrypted binary file and decrypt it.
So for this, we're going to run and KMS decrypt command.
So this time we pass in the blog, the
the file that was encrypted.
So this is where we're passing the file in here.
Then we query for the plain text value.
So the decrypted value
and we write this to another file that is going
to be base 64 encrypted, and we specify the region.
So let's go ahead.
KMS knows automatically which key to use for
the description
because it is included in the blob of encrypted value.
So let me enter this.
And so this has succeeded.
So now if I go to my example
file decrypted base 64, it is here.
It's a much shorter thing.
And now we're going to basic 64
decode this to get my text value.
So we'll have a different command again
if you're on Windows or if you're on Max, I'm on Mac
I'm going to use this one.
So I'm copying this command, pasting it.
And now we have done a base 64 decoding of our file.
So if we go back to example, file decrypted dot TXT
we find back our super secret password.
So we have shown the encryption and its reverse operation.
The decryption.
Obviously these are low level commands.
The SDK will abstract some of that for us
but this shows you the full example
of how you can use the encrypt and decrypt command
of KMS with your own customer master key.
So that's it super simple.
I hope that was helpful.
And I will see you in the next lecture.