KMS Notes

KMS - Key Management Service

Control encryption keys

Notes

Setup 2 users, one to manage the keys, but cannot encrypt/decrypt. The other user can encrypt/decrypt but not manage the keys.

AWS CLI

aws kms encrypt
aws kms decrypt
aws kms re-encrypt
aws kms enable-key-rotation

KMS Envelope Encryption

Encrypt envelope key with a CMK.
CMK is Customer Master Key
Keys used in KMS are envelope keys