Powerful encryption capabilities are available in the core services of the AWS cloud. AWS continues to release enhancements to encryption-specific services and expand encryption capabilities in new services to make security easy for everyone. Learn how to take advantage of these services and features to protect and secure your data in the cloud. Speaker: Dr. John Hildebrandt - Principle Solutions Architect, AWS

1. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
John Hildebrandt
Solutions Architect, Amazon Web Services
Using AWS Key Management Service
for Secure Workloads

2. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Background – IRAP
AWS Key Management Service (KMS) overview
Step through a example application

3. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Background - IRAP process update
AWS on ASD CCSL at Unclassified DLM.
Released Information Security Registered Assessors Program
(IRAP) PROTECTED documentation via AWS Artifact.
• 46 services in scope. Recommends use of KMS encryption and
key management.
• Supports DTA secure cloud strategy allowing agency based
assessments.
Continue to work with the Australian Signals Directorate to include
services at PROTECTED level on Certified Cloud Services List.

4. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IRAP scope
Analytics
Amazon Elastic MapReduce
(Amazon EMR)
Amazon Kinesis Data Streams
Amazon Kinesis Data Firehose
Desktop
Amazon WorkSpaces
Amazon WorkDocs
Storage
Amazon S3
Amazon S3 Transfer Acceleration
Amazon EBS
Amazon Glacier
Database
Amazon DynamoDB
Amazon Redshift
Amazon RDS
Amazon ElastiCache
Identity
Amazon Identity and Access
Management (IAM)
AWS Directory Services
Management
Amazon CloudWatch
Amazon CloudWatch Logs
AWS CloudFormation
AWS CloudTrail
AWS Config
App & Mobile
Amazon API Gateway
Amazon Simple Workflow Service
Amazon Cognito
AWS Step Functions
Messaging
Amazon Simple Notification Service
Amazon Simple Queue Service
Network
Amazon Virtual Private Cloud (Amazon
VPC)
AWS Direct Connect
Amazon CloudFront
Amazon Route 53
Security
Amazon Inspector
AWS Key Management Service
AWS CloudHSM
Amazon EC2 Systems Manager
AWS Web Application Firewall
AWS Shield
Compute
Amazon EC2
Amazon Elastic Container Service
(Amazon ECS)
AWS Auto Scaling
Amazon ELB
AWS Lambda
AWS Lambda@Edge
Source: https://console.aws.amazon.com/artifact/home?region=ap-southeast-2#!/reports

5. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Key Management Service
One-click Encryption
Centralized key management
(create, delete, view, set policies)
Enforced, automatic key rotation
Visibility into any changes via CloudTrail
AWS Config Rules validation
Encryption key management and compliance
Usage recommended in
Protected IRAP stage 2 report

6. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IRAP scope – KMS integrations *
Analytics
Amazon Elastic MapReduce
(Amazon EMR) *
Amazon Kinesis Data Streams *
Amazon Kinesis Data Firehose *
Desktop
Amazon WorkSpaces *
Amazon WorkDocs
Storage
Amazon S3 *
Amazon S3 Transfer Acceleration
Amazon EBS *
Amazon Glacier * (via S3 lifecycle)
Database
Amazon DynamoDB *
Amazon Redshift *
Amazon RDS *
Amazon ElastiCache
Identity
Amazon Identity and Access
Management (IAM) *
AWS Directory Services
Management
Amazon CloudWatch *
Amazon CloudWatch Logs *
AWS CloudFormation *
AWS CloudTrail *
AWS Config *
App & Mobile
Amazon API Gateway
Amazon Simple Workflow Service
Amazon Cognito
AWS Step Functions
Messaging
Amazon Simple Notification Service
Amazon Simple Queue Service *
Network
Amazon VPC * (end point)
AWS Direct Connect
Amazon CloudFront
Amazon Route 53
Security
Amazon Inspector
AWS Key Management Service *
AWS CloudHSM
Amazon EC2 Systems Manager *
AWS Web Application Firewall * (logs)
AWS Shield
Compute
Amazon EC2 * (via EBS)
Amazon ECS * (via EBS)
AWS Auto Scaling
Amazon ELB
AWS Lambda * (ENV var)
AWS Lambda@Edge

7. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Plaintex
t
data
Hardware/
software
Encrypted
data
Encrypted
data in storage
Encrypted
data key
Symmetric
data key
Master keySymmetric
data key
? Key hierarchy
?
Encryption primer

8. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
“Key” questions to consider with any solution
Where are keys stored?
• Hardware you own?
• Hardware the cloud provider owns?
Where are keys used?
• Client software you control?
• Server software the cloud provider controls?
Who can use the keys?
• Users and applications that have permissions?
• Cloud provider applications you give permissions?
What assurances are there for proper security around keys?

9. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
How clients and AWS services typically
integrate with KMS
Two-tiered key hierarchy using
envelope encryption
• Unique data key encrypts customer data
• KMS master keys encrypt data keys
Benefits
• Limits risk of compromised data key
• Better performance for encrypting large
data
• Easier to manage small number of
master keys than millions of data keys
• Centralized access and audit of key
activity
Customer master
keys
Data key 1
S3 object EBS
volume
Amazon
Redshift
cluster
Data key 2 Data key 3 Data key 4
Custom
application
KMS

10. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Your application or
AWS service
+
Data key Encrypted data key
Encrypted
data
Master keys in
customer’s account
KMS
How AWS services use your KMS keys
1. Client calls kms:GenerateDataKey by passing the ID of the KMS master key in your account.
2. Client request is authenticated based on permissions set on both the user and the key.
3. A unique data encryption key is created and encrypted under the KMS master key.
4. The plaintext and encrypted data key is returned to the client.
5. The plaintext data key is used to encrypt data and is then deleted when practical.
6. The encrypted data key is stored; it’s sent back to KMS when needed for data decryption.

11. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
KMS assurances
Why should you trust AWS with your keys?
• There are no tools in place to access your physical key material.
• Your plaintext keys are never stored in nonvolatile memory.
• You control who has permissions to use your keys.
• Separation of duties between systems that use master keys and
ones that use data keys.
• Multiparty controls for all maintenance of KMS systems that use
your master keys.

12. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Third-party evidence of these controls
• IRAP Protected report
• FIPS 140-2 validated hardware security modules to protect the
security of your keys
• FedRAMP
• HIPAA
• ISO 27001, 27017, 27018, 9001
• Service Organization Control (SOC 1,2,3)
• PCI-DSS
• Germany C5
https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3009.pdf

13. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Example Application
Typical web application stack.
Let’s apply KMS across the stack.
region
Availability Zone Availability Zone
virtual private cloud
VPC subnet VPC subnet
VPC subnet VPC subnet
Auto Scaling group
Web Tier Web Tier
Application Load
Balancer
RDS
Master instance
RDS DB instance
standby (multi-AZ)
S3 Bucket
Static content

14. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Web Tier
• EC2 instances with EBS storage
• EBS supports KMS encryption
for data and boot volumes
• EBS and KMS IAM based
access control applies
create-volume [--dry-run | --no-dry-run] [--size <value>] [--snapshot-id
<value>] --availability-zone <value> [--volume-type <value>] [--iops <value>]
[--encrypted | --no-encrypted] [--kms-key-id <value>] [--cli-input-json <value>]
[--generate-cli-skeleton]
AWS CLI/SDK

15. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Database Tier
• RDS instances with EBS storage
• KMS check box
• Logs and snapshots also encrypted

16. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
S3 – Static Content, logs, backups
• Server side KMS managed keys supported
• Bucket policy to require encryption

17. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Validate KMS in use – AWS Config
• Leverage AWS Config
Rules to validate
continuous compliance
AWS Config

18. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
You control how and when your KMS keys can
be used and by whom
Sample permissions on a key:
• Can only be used for encryption and decryption by <these users and
roles> in <this account>
• Can only be used by application A to encrypt data, but only used by
application B to decrypt data
• Can only be used to decrypt data if the service resource is active and
additional parameters about the resource are passed in the call
• Can be managed only by this set of administrator users or roles
Fully integrated with AWS Identity and Access Management

19. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Rotating keys in KMS
What key rotation means:
• A new version of a master key is created, but mapped to the same
key ID or alias
• All new encryption requests use the new version
• All previous versions of keys are kept to perform decryption on
older ciphertexts
There is nothing users/applications need to do after a rotation –
the same keyID or alias just works
AWS CLI
enable-key-rotation --key-id <value>
Console (Key Summary Page)

20. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Auditability of KMS key usage through
AWS CloudTrail
"EventName":"DecryptResult", This KMS API was called…
"EventTiime":"2014-08-18T18:13:07Z", ….at this time
"RequestParameters":
"{"keyId":"2b42x363-1911-4e3a-8321-6b67329025ex”}”, …in reference to this key
“EncryptionContext":"volumeid-12345", …to protect this AWS resource
"SourceIPAddress":"42.23.141.114 ", …from this IP address
"UserIdentity":
“{"arn":"arn:aws:iam::123456789012:user/User123“} …by this AWS user in this account

21. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Automation
• AWS CloudFormation – scripted deployment
• Service Catalog – standard service offerings
• AWS Landing Zone – standard account set up

22. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Summary
• AWS KMS called out in IRAP report for Protected workloads
• AWS KMS subject of multiple 3rd party audits
• Integrated across AWS for ease of use
• Demonstrated application across common workload

23. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Resources
KMS
• https://aws.amazon.com/kms
Whitepaper on KMS cryptographic details
• https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf
Whitepaper on KMS best practices
• https://d0.awsstatic.com/whitepapers/aws-kms-best-practices.pdf
AWS Encryption SDK
• http://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/introduction.html
S3 encryption client
• http://aws.amazon.com/articles/2850096021478074
AWS Security Blog
• http://blogs.aws.amazon.com/security

24. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.