# 🚀 AWS KMS Tutorial

**full AWS KMS (Key Management Service) tutorial**, similar in style to the previous tutorials, with **concepts, use-cases, step-by-step setup, examples for S3 and snapshots, security before/after KMS, and fintech-specific considerations**.

---

---

## 1️⃣ What is AWS KMS?

* **AWS KMS (Key Management Service)** is a fully managed **encryption key service**.
    
* Enables you to **create, manage, and control cryptographic keys** used to encrypt your data across AWS services.
    
* Supports both **symmetric** and **asymmetric keys**.
    

---

## 2️⃣ Why Do We Use KMS?

* Protect sensitive data at rest (databases, S3, EBS).
    
* Comply with regulations (PCI-DSS, HIPAA, GDPR).
    
* Control who can **encrypt/decrypt** data via IAM policies.
    
* Enable **secure sharing of snapshots or objects** across accounts.
    

📌 For a fintech wealth advisory platform:

* Encrypt **S3 buckets storing customer PII**.
    
* Encrypt **RDS/EBS snapshots** before sharing.
    
* Ensure **audit trails** of who accessed keys/data.
    

---

## 3️⃣ Key Concepts

| Term | Description |
| --- | --- |
| **CMK (Customer Master Key)** | Primary key you manage in KMS. Can be symmetric or asymmetric. |
| **Data Key** | Key used to encrypt actual data, generated by CMK. |
| **Key Policy** | IAM-like policy that controls access to CMK. |
| **Envelope Encryption** | Use CMK to encrypt data keys; data key encrypts actual data. |
| **Key Rotation** | Automatic yearly rotation of CMKs for compliance. |

---

## 4️⃣ Before & After Using KMS

### Without KMS:

* S3 bucket or snapshot encrypted using **default service-managed keys**.
    
* Harder to manage cross-account sharing.
    
* Limited control on **who can decrypt**.
    

### With KMS:

* Customer-defined CMK.
    
* Fine-grained access via **IAM & key policies**.
    
* Audit trail via **CloudTrail**.
    
* Can share encrypted snapshots across AWS accounts.
    

---

## 5️⃣ Step-by-Step Example

### 🔹 Step 1: Create a KMS CMK

```plaintext
aws kms create-key \
  --description "Fintech S3 Encryption Key" \
  --key-usage ENCRYPT_DECRYPT \
  --origin AWS_KMS
```

Output includes **KeyId**.

Optional: Enable **automatic rotation**:

```plaintext
aws kms enable-key-rotation --key-id <KeyId>
```

---

### 🔹 Step 2: Create an S3 Bucket with KMS Encryption

```plaintext
aws s3api create-bucket --bucket fintech-data-bucket --region us-east-1

aws s3api put-bucket-encryption \
  --bucket fintech-data-bucket \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "<KeyId>"
      }
    }]
  }'
```

Now all objects uploaded to this bucket are **encrypted with your CMK**.

---

### 🔹 Step 3: Upload a File to the Bucket

```plaintext
aws s3 cp customer_data.csv s3://fintech-data-bucket/ --sse aws:kms --sse-kms-key-id <KeyId>
```

---

### 🔹 Step 4: Share an EBS Snapshot Across Accounts

1. Create snapshot:
    

```plaintext
aws ec2 create-snapshot --volume-id vol-0abcd1234efgh5678 --description "Fintech DB Snapshot"
```

2. Share snapshot with another AWS account:
    

```plaintext
aws ec2 modify-snapshot-attribute \
    --snapshot-id snap-0abcd1234efgh5678 \
    --attribute createVolumePermission \
    --operation-type add \
    --user-ids 123456789012
```

3. Encrypt snapshot with CMK:
    

```plaintext
aws ec2 copy-snapshot \
    --source-region us-east-1 \
    --source-snapshot-id snap-0abcd1234efgh5678 \
    --encrypted \
    --kms-key-id <KeyId> \
    --description "Encrypted Fintech Snapshot"
```

Now only users with **permission on the CMK** can access the snapshot in the target account.

---

## 6️⃣ Securing Data with KMS

* **Data at rest**: All S3 objects, EBS volumes, and RDS snapshots encrypted.
    
* **Access control**: IAM policies + Key policies restrict who can encrypt/decrypt.
    
* **Audit trail**: CloudTrail logs **every use of the CMK**.
    
* **Rotation**: Automatic yearly key rotation ensures compliance.
    

---

## 7️⃣ Best Practices (Fintech Context)

1. Always use **customer-managed CMKs** instead of AWS-managed keys for critical data.
    
2. Enable **automatic key rotation**.
    
3. Limit key access via **least privilege IAM roles**.
    
4. Use **envelope encryption** for large objects to save cost.
    
5. Regularly **audit CloudTrail logs** to monitor key usage.
    
6. Encrypt all **S3 buckets containing customer PII or financial data**.
    

---

## 8️⃣ Advantages

✅ Fine-grained encryption control.  
✅ Centralized key management.  
✅ Cross-account secure sharing.  
✅ Compliant with major standards (PCI, HIPAA, GDPR).  
✅ Works with most AWS services (S3, EBS, RDS, Lambda, etc.).

---

## 9️⃣ Limitations

❌ Adds **latency** during encrypt/decrypt operations.  
❌ Cost for CMK usage (requests + storage).  
❌ Cross-region usage requires copying CMKs or encrypted data.  
❌ Requires careful IAM/key policy management.

---

## 10️⃣ 🎯 Interview Q&A

**Q1. What is AWS KMS and why do we use it?**  
👉 KMS is AWS Key Management Service. Used to encrypt/decrypt data securely, manage keys, enforce access policies, and maintain compliance.

**Q2. Difference between KMS and default AWS encryption?**  
👉 Default encryption uses AWS-managed keys (limited control). KMS allows **customer-managed keys**, fine-grained access, and audit logging.

**Q3. How do you encrypt an S3 bucket with KMS?**  
👉 Create CMK → apply bucket encryption rule → upload objects specifying CMK.

**Q4. How can snapshots be shared securely?**  
👉 Encrypt snapshot with CMK → grant `createVolumePermission` to target account → only users with KMS permissions can access.

**Q5. How does KMS ensure security before/after usage?**  
👉 Before: data unencrypted or AWS-managed key. After: encrypted with CMK, access restricted, usage logged, rotation enabled.

**Q6. How to reduce costs with KMS?**  
👉 Use envelope encryption for large objects → reduce CMK usage requests.

**Q7. In fintech, which resources must be encrypted with KMS?**  
👉 S3 buckets with customer PII, RDS/EBS snapshots, EBS volumes storing transactional data, Lambda environment variables containing secrets.

**Q8. Can KMS be used cross-region?**  
👉 Yes, but CMKs are region-specific. You may need to **copy snapshots or objects** to another region and encrypt with a region-specific CMK.

---

✅ That’s a **complete AWS KMS tutorial**, with **S3 & snapshot examples, security before/after KMS, and fintech best practices + interview prep**.

I can also create a **ready-to-run demo script** that:

* Creates an S3 bucket with KMS encryption,
    
* Uploads a file,
    
* Creates and shares an encrypted snapshot,
    
* Then prints **access PASS/FAIL** for testing.
    

# **Comparison of Customer-Managed vs AWS-Managed keys**

Perfect ✅ Let’s extend the **AWS KMS tutorial** with a full **comparison of Customer-Managed vs AWS-Managed keys**, pricing considerations, multi-region strategy for your **wealth advisory fintech app** (Australia primary, Singapore DR), and interview-style Q&A.

---

# 🔑 AWS KMS: Customer-Managed vs AWS-Managed Keys

---

## 1️⃣ Key Types

| Feature | AWS Managed Key (AWS-KMS / AWS/S3) | Customer Managed Key (CMK) |
| --- | --- | --- |
| **Management** | AWS handles key creation, rotation, and policies | You create, rotate, and manage key policies |
| **Access Control** | Limited; only service-level IAM policies | Fine-grained IAM + key policies |
| **Rotation** | Automatic every 3 years (service-defined) | Optional automatic yearly rotation or manual |
| **Cross-service use** | Yes, limited to AWS service | Yes, across multiple AWS services |
| **Audit & Logging** | CloudTrail logs usage | CloudTrail logs usage (all API calls) |
| **Cost** | Free | $1 per CMK/month + $0.03 per 10,000 requests |
| **Use-case** | Non-critical, general encryption | Critical data, regulatory compliance, cross-account sharing |

---

## 2️⃣ Pricing Overview

| Component | AWS Managed | Customer Managed |
| --- | --- | --- |
| **Key creation** | Free | $1 per key/month |
| **API Requests** | Free | $0.03 per 10,000 requests |
| **Key storage** | Free | Included in monthly key cost |
| **Automatic rotation** | Yes | Optional (free if enabled) |

💰 **Example**: For your fintech app with 5 CMKs and ~100k encrypt/decrypt requests/month:

* CMK cost: 5 × $1 = $5/month
    
* Request cost: 100k ÷ 10k × $0.03 = $0.30/month
    
* Total ≈ $5.30/month → very low relative to business value.
    

---

## 3️⃣ Multi-Region Strategy for Fintech App

**Setup**:

* **Primary region**: Australia (ap-southeast-2) → holds production data.
    
* **Secondary region**: Singapore (ap-southeast-1) → DR/replica.
    

**Recommendation**:

* Use **Customer Managed Keys** for sensitive data (S3 buckets, RDS/EBS snapshots).
    
* Enable **cross-region key replication**: copy encrypted snapshots or objects from AU to SG using CMK in SG.
    
* Keep AWS-managed keys for **non-critical service-managed encryption** (e.g., logs, temporary cache).
    

---

### 🔹 Example Scenario

1. **S3 Bucket Encryption (AU)**
    

* Create CMK in AU (`fintech-cmk-au`).
    
* Encrypt all customer PII S3 objects with this key.
    

2. **Cross-Region Snapshot (AU → SG)**
    

* Create snapshot of production RDS.
    
* Encrypt snapshot with `fintech-cmk-au`.
    
* Copy snapshot to Singapore, re-encrypt with `fintech-cmk-sg`.
    
* Only users with access to respective CMKs can decrypt.
    

3. **Benefits**
    

* Regulatory compliance (PCI-DSS requires encryption & key control).
    
* Fine-grained access control (different teams in AU & SG).
    
* Auditability with CloudTrail.
    

---

## 4️⃣ Interview Q&A

**Q1. Difference between AWS-managed and customer-managed keys?**  
👉 AWS-managed: free, automatic rotation, limited access control, suitable for non-critical data.  
👉 Customer-managed: you create/manage key policies, fine-grained access, cross-account/region sharing, rotation control, audit logging.

**Q2. Which keys would you use for a wealth advisory fintech platform?**  
👉 Customer-managed keys for sensitive data (S3 buckets, RDS/EBS snapshots) in **AU primary** and **SG DR**. AWS-managed keys can be used for logs, caches, or non-sensitive resources.

**Q3. How do you share snapshots securely across accounts/regions?**

1. Encrypt snapshot with CMK.
    
2. Grant target account permission via `createVolumePermission`.
    
3. Target account can decrypt only if it has CMK access.
    
4. Cross-region: copy snapshot to SG and re-encrypt with SG CMK.
    

**Q4. How do you reduce cost while using CMKs?**

* Use envelope encryption for large objects → fewer CMK requests.
    
* Reuse CMKs across multiple resources where compliance allows.
    
* Enable auto key rotation → no manual recreation costs.
    

**Q5. How do you ensure audit and compliance?**

* CloudTrail logs all KMS API calls.
    
* Enforce IAM least privilege + key policies.
    
* Enable cross-region replication only for authorized accounts.
    

**Q6. How do you explain to a manager why CMKs cost money but AWS-managed are free?**  
👉 CMKs give **full control, auditability, cross-account/region sharing**, and are essential for sensitive fintech data. AWS-managed keys are fine for non-critical resources.

**Q7. How does KMS improve security before and after its use?**

* Before: data may be unencrypted or only service-encrypted with limited control.
    
* After: data encrypted with CMK, access restricted, CloudTrail logs all activity, can rotate keys, supports compliance standards.
    

**Q8. What’s the recommended rotation period for fintech data?**

* Automatic yearly rotation is standard.
    
* For PCI-DSS/HIPAA critical data, consider **manual quarterly rotation** if required by compliance policy.
    

**Q9. Can CMKs be used for multiple services?**

* Yes. A single CMK can encrypt S3 objects, RDS/EBS snapshots, Lambda environment variables, and more.
    

**Q10. If KMS fails in a region, what’s your DR strategy?**

* Keep a secondary CMK in DR region.
    
* Copy snapshots/objects encrypted with primary CMK to DR region and re-encrypt.
    
* Validate DR restore procedures regularly.
    

---

✅ That’s a **complete AWS KMS tutorial with CMK vs AWS-managed keys, pricing, fintech multi-region strategy, security before/after, and interview prep**.

I can also create a **ready-to-run demo script** that:

* Creates CMKs in AU/SG,
    
* Encrypts an S3 bucket and uploads a file,
    
* Creates an RDS snapshot and copies it to SG,
    
* Then prints **access PASS/FAIL** to simulate secure sharing.
    

---