KMS encryption keys

Sign in and set up names:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$acct = aws sts get-caller-identity --query Account --output text
$myArn = aws sts get-caller-identity --query Arn --output text
$bucket = "saat-kms-$acct-ap-south-1-an"

1Create a key and read its policy

Paste this whole block:

$key = aws kms create-key --description "saat lab data key" --tags TagKey=course,TagValue=saatvedha-aws --query KeyMetadata.KeyId --output text
$keyArn = aws kms describe-key --key-id $key --query KeyMetadata.Arn --output text
aws kms create-alias --alias-name alias/saat-data --target-key-id $key
(aws kms get-key-policy --key-id $key --policy-name default --query Policy --output text | ConvertFrom-Json).Statement | Select-Object Sid, Effect, @{n='Principal';e={$_.Principal.AWS}}, Action

You should see something like this:

Sid                           Effect Principal                         Action
---                           ------ ---------                         ------
Enable IAM User Permissions   Allow  arn:aws:iam::111122223333:root    kms:*

That single statement means “this account’s IAM policies decide who can use the key”. Remove it, and only principals named in the key policy can use the key, whatever IAM says.

2Encrypt and decrypt a secret

Paste this whole block:

Set-Content -NoNewline secret.txt "db_password=Saat-Lab-Not-Real-123"
$ct = aws kms encrypt --key-id alias/saat-data --plaintext fileb://secret.txt --query CiphertextBlob --output text
[IO.File]::WriteAllBytes("$PWD\secret.enc", [Convert]::FromBase64String($ct))
Remove-Item secret.txt
$pt = aws kms decrypt --ciphertext-blob fileb://secret.enc --query Plaintext --output text
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($pt))
$dk = aws kms generate-data-key --key-id alias/saat-data --key-spec AES_256 --output json | ConvertFrom-Json
"plaintext data key: $([Convert]::FromBase64String($dk.Plaintext).Length) bytes, encrypted copy: $([Convert]::FromBase64String($dk.CiphertextBlob).Length) bytes"
Remove-Variable dk

You should see something like this:

db_password=Saat-Lab-Not-Real-123
plaintext data key: 32 bytes, encrypted copy: 184 bytes

Decrypt didn’t need the key ID: the ciphertext records which key made it. The data key is what S3 and EBS use; you’d encrypt a file with the 32-byte key, store the 184-byte encrypted copy beside it, and forget the plaintext.

3Use the key for an S3 bucket

Paste this whole block:

aws s3api create-bucket --bucket $bucket --bucket-namespace account-regional --region ap-south-1 --create-bucket-configuration LocationConstraint=ap-south-1 | Out-Null
'{ "Rules": [ { "ApplyServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "KEY_ARN" }, "BucketKeyEnabled": true } ] }' -replace 'KEY_ARN', $keyArn | Set-Content kms-enc.json
aws s3api put-bucket-encryption --bucket $bucket --server-side-encryption-configuration file://kms-enc.json
Set-Content oct.csv "employee,net_pay"
aws s3 cp oct.csv "s3://$bucket/payroll/oct.csv" | Out-Null
aws s3api head-object --bucket $bucket --key payroll/oct.csv --query "[ServerSideEncryption,SSEKMSKeyId]" --output text
aws kms enable-key-rotation --key-id $key --rotation-period-in-days 365
aws kms get-key-rotation-status --key-id $key --query "[KeyRotationEnabled,RotationPeriodInDays]" --output text

You should see something like this:

aws:kms arn:aws:kms:ap-south-1:111122223333:key/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
True    365

The payroll object is now protected by your key, not the AWS managed aws/s3 key from Lesson 17. Rotation will create new key material every year; nothing changes for the bucket or the apps.

4See every use in CloudTrail

Paste this whole block. KMS events usually appear within five minutes:

do { Start-Sleep 30; $e = aws cloudtrail lookup-events --lookup-attributes "AttributeKey=ResourceName,AttributeValue=$keyArn" --max-results 20 --query "Events[].EventName" --output text } until ($e -match 'Decrypt')
$e

You should see something like this:

GenerateDataKey Decrypt GenerateDataKey Encrypt EnableKeyRotation CreateAlias CreateKey

Every encrypt, decrypt and data key request is a CloudTrail event naming the caller. That is why auditors like customer managed keys: you can prove who read the payroll data.

✅ Checkpoint: alias/saat-data exists with the root statement in its policy, you decrypted the secret, payroll/oct.csv uses your key, rotation is True at 365 days, and CloudTrail shows the KMS calls. Keep everything for the break lab.