Customer Master Key (CMK) Policy Management in AWS KMS

What is a Customer Master Key (CMK)?

In security, a master key is what you use to encrypt all other encryption keys in your system. Customer master keys are logical representations of a master key. They are the primary resources in AWS KMS. The CMK contains the key material used to encrypt and decrypt data. It also contains metadata such as the key ID, creation date, description, and key state.

You can start using AWS KMS through the web console or via API. There are two types of CMKs that you can create in AWS KMS: symmetric CMK and asymmetric CMK. 

  • A symmetric CMK is a 256-bit key that is used for standard encryption and decryption. 
  • An asymmetric CMK, on the other hand, is an RSA key pair that is used for encryption and decryption or signing and verification, but not both, or an elliptic curve (ECC) key pair that is used for signing and verification.

Likewise, AWS breaks down CMK ownership into three categories: customer-managed CMKs, AWS managed CMKs, and AWS owned CMKs. Generally, when you create a CMK, AWS KMS provides the key material for it; But if you require to have full control of your keys, customer-managed CMKs allow you to upload your own key material into AWS. The level of control you have varies for each category, with customer-managed CMKs being the most unrestricted, to AWS owned CMKs being the most restrictive. 

IT Certification Category (English)728x90

How To Manage Access To Your CMKs

To protect your CMKs from unauthorized access, you must attach a key policy to it. Key policies help protect your CMKs by defining specific requirements that must be fulfilled before an action is permitted. The policy structure is similar to IAM policies, and it also uses JSON formatting. Here is a basic example of a key policy:

Customer Master Keys (CMKs)

To create your key policy, you must first indicate the policy version you will be using. Then in the statement body, you must include the following parameters:

  • Effect – indicates whether the policy will allow or deny actions
  • Principal – the identity to which the policy will grant or deny permissions to
  • Action – the permissions that you want to grant/deny to the principal
  • Resource – the list of objects that your policy will be applied to

You can also include the following optional parameters in your statement body:

  • Sid – a unique identifier for your policy
  • Conditions – conditions that need to be met before your policy takes effect

The AWS KMS documentation has a list of all accepted values for the policy body, along with some examples to guide you through.

The key policy applied to a CMK created through the AWS KMS API

When you create a CMK using the API and you do not provide a key policy in the parameters, AWS automatically creates and assigns a default key policy for your CMK. This default key policy has one policy statement that gives the AWS root account that owns the CMK full access to the CMK and enables IAM policies in the account to allow access to the CMK. If later on, you decide to change the contents of the key policy, you need to create a new policy and attach it to your CMK to replace the old one.

The key policy applied to a CMK created through the AWS Management Console

When you create a CMK with the AWS Management Console, you can choose the IAM users, IAM roles, and AWS accounts that should be given access to the CMK, and these will be added to a default key policy that the console creates for you. With the console, you can view or modify your key policies. The default key policy gives the AWS root account that owns the CMK full access to the CMK. You can also specify in the default key policy which IAM users and roles will be key administrators and key users, which have different respective policy statements.

Sources: 
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys
https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
https://docs.aws.amazon.com/kms/latest/developerguide/control-access-overview.html#managing-access

***

AWS Certifications are consistently among the top paying IT certifications in the world, considering that Amazon Web Services is the leading cloud services platform with almost 50% market share! Earn over $150,000 per year with an AWS certification!

Subscribe to our newsletter and notifications for more helpful AWS cheat sheets and study guides like this and answer as many AWS practice exams as you can.🙂

NEW eBook – Solutions Architect Associate Exam Study Guide and Cheat Sheets

AWS Certified Solutions Architect Associate eBook version2

NEW Course – AWS Certified Security Specialty Practice Exams 2020

AWS Certified Security - Specialty Exam Study Path

Enroll Now – AWS Certified Cloud Practitioner Practice Exams 2020

AWS Certified Cloud Practitioner New

Enroll Now – AWS Certified Solutions Architect Associate Practice Exams 2020

AWS Certified Solutions Architect Associate Practice Exams New

Enroll Now – AWS Certified Developer Associate Practice Exams 2020

AWS Certified Developer Associate New

Enroll Now – AWS Certified SysOps Administrator Associate Practice Exams 2020

AWS Certified SysOps Administrator Associate New

Enroll Now – AWS Certified Solutions Architect Professional Practice Exams 2020

AWS Certified Solutions Architect Professional New

Enroll Now – AWS Certified DevOps Engineer Professional Practice Exams 2020

AWS Certified DevOps Engineer Professional Practice Exams New

Browse Other Courses

Generic Category (English)300x250

Recent Posts