Photo by Markus Winkler by Unsplash on Unsplash
The Key Management Service is an HSM solution provided by AWS to create and manage encryption keys used for encrypting data, code signing, and HMAC. An AWS KMS key is a logical representation of a cryptographic key containing metadata such as the key ID, key spec, key usage, creation date, description, and a reference to the key material used when performing cryptographic operations with the KMS key.
AWS provides options for customers to manage their own keys or leverage AWS for managing the keys.
Customers can create, own, and manage KMS keys, retaining full control over these keys. This includes establishing and maintaining key policies, IAM policies, and grants, enabling/disabling keys, rotating cryptographic material, adding tags, creating aliases referring to the keys, and scheduling keys for deletion. AWS also allows customers to bring their own encryption keys into KMS.
AWS managed keys are KMS keys in customers accounts created, managed, and used by AWS for specific services. Customers can view these keys, their key policies, and audit their use in AWS CloudTrail logs but cannot change their properties, rotate them, change their key policies, or schedule them for deletion.
AWS also offers options to create your own HSM store or use keys from an external key store.
If you found this helpful, please like and share to support the content!
Always curious to understand the concept, learning by breaking and fixing, and passionate about sharing knowledge with the community.Get in touch with me→
Rotating encryption keys on customer managed kms keys
Regularly changing encryption keys is crucial for maintaining security and is a requirement from certain clients. This blog post discusses the solution options for rotating customer-managed encryption keys stored on Amazon-managed HSM stores. It does not address the rotation of KMS keys within customer-managed HSM stores or external key stores
AWS allows customers to rotate customer-managed keys once a year, while AWS automatically rotates AWS managed keys. However, AWS does not provide an option to rotate encryption data keys on a custom schedule, such as monthly or quarterly.
This blog post explores solution options for handling custom data key rotation on KMS.
Simple approach is to create a new KMS key at the required frequency, either monthly or quarterly, and assign the same alias to the newly created KMS key. In this option ,AWS handles the creation of encryption keys.
Design: Incorporate the logic for creating new KMS keys and assigning aliases to the new KMS keys within a Lambda function. EventBridge is utilised to schedule these Lambda functions at agreed-upon intervals. Upon the creation of new KMS keys, notifications should be sent to the required stakeholders to notify them that the key has been rotated.
Create a new KMS key without any key material, and then generate the encryption key externally, importing it into KMS. In this approach, the customer is responsible for generating the encryption data key and importing it into KMS.
AWS CLI and Open SSL commands generate new key and import key into kms:
Press enter or click to view image in full size
you can automate the solution using commands provided above in many ways based on the security requirements around the encryption keys
In summary, we try to explore the solutions for rotating data encryption keys within customer-managed KMS, recognising that AWS offers limited opportunities to rotate these keys typically once per year .

Delete your Dockerfile. Learn how Paketo Buildpacks use the pack CLI to create secure, SBOM-ready Node.js images automatically.

Cloud Native Buildpacks eliminate the Dockerfile entirely. Discover the 5-phase lifecycle, core components, and advanced security mechanics that make CNB the enterprise standard for container builds.