Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

AWS Security Series: Key Management Service ( KMS )

Name: AWS Security Series: Key Management Service ( KMS )
Rating: 4.3 (92 reviews)

Learn the key components of KMS with hands on labs.

Created byBipra Tech, Saurav Sharma, Cloud Yeti

Last updated 5/2018

English

English [Auto],

What you'll learn

Student will gain a thorough understanding of Key Management Service (KMS) and its workings.
Prepare for AWS certification exams that demand in-depth knowledge of KMS.
Students will learn how to protect data at rest using KMS.

Course content

6 sections • 26 lectures • 2h 27m total length

Introduction2:10
Explore the AWS key management service (KMS) concepts in this introduction, designed to simplify KMS and support certification prep for associate, professional, and security exams for cloud and security engineers.
Course Overview2:00
Course Slides PDF0:07

KMS Terminologies4:54
Learn key management service terminologies, including data at rest and in transit, encryption and decryption, plaintext and ciphertext, symmetric and asymmetric keys, HSMs, CMKs, data keys, envelope encryption, and alias.
Components of KMS9:17
Explore how AWS KMS uses hardware security modules to manage customer master keys and data keys, enabling envelope encryption, generating and importing key material, and service integration.
KMS Pricing and cost2:00
https://aws.amazon.com/kms/pricing/
Demo: Customer Master Key Creation1:39
Discover how to create a customer master key in the AWS KMS console, set an alias and description, generate a key policy, and assign a key admin and key user.

Access Control on KMS Lecture9:31
IAM policy Evaluation Logic:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
LAB: Create KMS Access IAM Policy5:04
IAM policy Evaluation Logic:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
LAB: Create IAM Users that can use the keys5:10
IAM policy Evaluation Logic:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
LAB: Create a Customer Master Key with KMS Generated Key Material8:58
Learn to create a customer master key (CMK) in AWS KMS with default KMS generated key material, assign admins and users, and understand key policy, aliases, and tags.
LAB: Create a Customer Master Key with Imported Key Material11:54
Importing Key Material Reference:https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html
Install the AWS Command Line Interface (CLI)2:13
CLI Documentation Page with install links:

https://aws.amazon.com/cli/
LAB: Setup User Profiles on the Command Line Interface6:50
Configure AWS CLI profiles for users a, b, and c using their access keys, then test permissions by listing S3 buckets and preparing to encrypt and decrypt with KMS keys.
LAB: KMS and Customer Master Key Access Control8:29
IAM policy Evaluation Logic:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html

LAB: Encrypt data with KMS Customer Master Key (CMK)14:19
KMS CLI:

https://docs.aws.amazon.com/cli/latest/reference/kms/index.html
LAB: Encrypt data with Data Keys6:36
KMS CLI:

https://docs.aws.amazon.com/cli/latest/reference/kms/index.html
LAB: Encrypt S3 buckets and objects using a KMS Customer Master Key7:29
Encrypt S3 data with a KMS customer master key or the S3 master key, applying at bucket or object level and choosing region-specific, account-specific keys.
LAB: Encrypt S3 objects with CMK using the Command Line Interface (CLI)3:17
S3 CLI Reference:

https://docs.aws.amazon.com/cli/latest/reference/s3/
Create CMK Grants and delegate access to AWS principals10:54
I have added this access control Lab in this section because we have to know few commands for this lab which we covered in this section.

AWS GRANTS LAB:

Encrypt a plaintext with userB: aws kms encrypt --plaintext "hello" --key-id alias/myKMSgeneratedKey --profile userB
Encrypt a plaintext with userD: aws kms encrypt --plaintext "hello" --key-id alias/myKMSgeneratedKey --profile userD
Go to CLI Documentation and read the create-grant section: https://docs.aws.amazon.com/cli/latest/reference/kms/create-grant.html | Aliases is not supported for this command. There are few mandatory field and some optional.
Command to create grant: aws kms create-grant --key-id arn:aws:kms:us-east-1:3700003135:key/2a3434343d9-8296-4ed4-bc5c-398e5c4cc449 --grantee-principal arn:aws:iam::3782223433135:user/userD --name "userD-grant" --operations "Encrypt" --profile userB
Use the grant token to encrypt with userD. All you need to provide is the keyID and grant token that was granted with the previous request.
Try generating Data Key with the grant token: aws kms generate-data-key --key-id arn:aws:kms:us-east-1:3784433135:key/2a82fad9-8296-4ed4-bc5c-398e5c4cc449 --grant-tokens Abcdefddsdsd --profile userD
Use grant token to generate data keys for UserD and userD should be able to generate data keys: aws kms generate-data-key --key-id arn:aws:kms:us-east-1:378423343435:key/2adssdsfad9-8296-4ed4-bc5c-398sdsdc449 --grant-tokens xxxxxxxx --number-of-bytes 256 --profile userD
List all the grants: aws kms list-grants --key-id arn:aws:kms:us-east-1:378423433135:key/2a82fad9-8296-4ed4-bc5c-398e5c4cc449 --profile userB
Revoke grant to stop userD from using it: aws kms revoke-grant --key-id arn:aws:kms:us-east-1:378423433135:key/2a82fad9-8296-4ed4-bc5c-398e5c4cc449 --grant-id b2f1a9178327deceac90c9e5525adf7d2a79ce6aa6382a0c32fc148c379f90a3 --profile userB
LAB: Encrypt an EBS volume with your KMS Customer Master Key1:50
Learn to encrypt an EBS volume using your KMS customer master key by enabling encryption during volume creation and selecting the desired key.
LAB: Encrypt an unencrypted EBS volume5:25

Key Management Lecture: Disable, Rotate and Delete CMK's8:19
Enable automatic rotation for customer master keys with generated material to renew backing key yearly, while preserving the key ID and aliases, and schedule deletion with a 7-30 day wait.
LAB: Disable a Customer Master Key(CMK)3:32
Learners practice enabling and disabling a customer master key in AWS KMS, noting that a disabled CMK cannot encrypt or decrypt data, and that S3 keys can't be disabled.
LAB: Delete a Customer Master Key(CMK)3:54
Schedule deletion of a customer master key in AWS KMS within seven to thirty days, noting the pending deletion state and that data cannot be decrypted.

Requirements

Basic AWS knowledge is required
Basic knowledge of encryption/decryption

Description

This course provides a complete hands on introduction to AWS Key Management Service(KMS). We have a fast paced style of delivery. The lectures and labs/demo are planned and edited to pack the most content in shortest time. This is a must take course to pass the AWS Security exam. Taught by an instructor who has successfully passed the AWS Security Speciality Exam.

This course includes Labs/demo using the Management Console and the command line interface(CLI).

What the students are saying:

"The pace is good, the presenter peaks very clearly, and the information is presented in a very straightforward way - it is clear they thought a lot about how to present the information in the most clear and concise way."

"Very clear Awesome Pace"

"I really enjoyed the course. I picked up a thing or 2. I think the topic was covered well."

"Great explanation on basic fundamentals"

We will cover topics including:

- Customer Master Key creation with Imported Key Materials

- Generating and using data keys

- Using CMK to import data

- Key Rotation

- Key Access controls

- AWS Managed vs Customer Managed Keys

- Key Lifecycle Management

Why take this course?

1) KMS is integral to encryption of data on AWS.

2) KMS is featured in several AWS Exams and heavily featured in the AWS Security exam.

3) To get an good understanding of KMS so you can identify the best solutions which KMS provides and fits your need.

4) You will get all the future updates we have on the course.

5) Get free Course Slides that you can use for study

6) 30 day money- back guarantee. If you aren't satisfied, we will happily refund you.

7) The instructor is 12x AWS Certified including the AWS Security speciality cert where KMS is heavily featured.

Who this course is for:

Anyone learning and using AWS
Anyone who needs to secure data on AWS using encryption keys they manage
Those preparing for the AWS Security Speciality Exam and other exams

AWS Security Series: Key Management Service ( KMS )

What you'll learn

Explore related topics

Course content

Introduction to the course3 lectures • 4min

KMS: Components, Terminologies and Cost4 lectures • 18min

KMS Access Control8 lectures • 58min

Putting the Customer Master Key(CMK) to use7 lectures • 50min

KMS Key Management: Disabling, Rotating and Deleting Keys3 lectures • 16min

Course Summary1 lecture • 2min

Requirements

Description

Who this course is for: