Ultimate Hands-On AWS KMS Course 2026

AWS KMS creates and controls cryptographic keys for encryption, decryption, signing and verification. It also stores, rotates, audits, and manages access.

Explore AWS KMS key types by ownership—AWS owned, AWS managed, and customer managed—and learn how symmetric and asymmetric keys enable encryption, decryption, and digital signatures with policy and rotation considerations.

Understand envelope encryption with KMS and customer managed keys. Encrypt the data key with a master key to store encrypted data and keys, enabling scalable, centralized key management.

Learn envelope encryption in aws kms by creating a symmetric hsm backed key, hbk protected as export key token, using derived encryption key and nonce to encrypt data key.

Understand how KMS access control uses both the key policy and IAM permissions, with examples showing a test user able to generate a data key via either policy.

Explore how AWS KMS and IAM roles control S3 encryption and envelope encryption, showing how generate data key and decrypt permissions enable uploading and downloading encrypted objects.

Demonstrate enforcing access control with a KMS key policy for AWS Lambda by granting describe key, generate data key, and decrypt permissions to protect lambda code and environment variables.

Use visual policy editor to assign key administrators and key users in AWS KMS; admins get delete and describe, while users get encrypt, decrypt, generate data key, and grant access.

Learn to grant decrypt access to a test user for encrypted lambda environment variables using aws kms grants, including creating, listing, waiting for eventual consistency, and revoking grants.

Explore how AWS KMS auditing works with CloudTrail, showing management and data events for envelope encryption and calls like generate data key, encrypt, and decrypt.

Discover how AWS KMS rotates key material, generating new material while preserving old for decryption, enable automatic or on-demand rotation, and manage costs and scheduled deletion.

Learn to build a secure serverless password manager on AWS using KMS for envelope encryption, Lambda, DynamoDB, API Gateway, and Cognito, storing encrypted passwords with a composite key.

Explore asymmetric key cryptography in aws kms by generating an rsa 2048 key to sign and verify a json web token, using the public key for verification.

Explore JWT-based authentication using an authorization server to sign tokens with a private key and verify with a public key, plus signup and login lambdas, DynamoDB, and KMS.

Execute a resource cleanup after the course by deleting KMS keys, DynamoDB tables, Lambda functions, an S3 bucket, API gateways, Cognito user pool, roles, and test users to prevent charges.