Skip to content

Lab 3 · KMS & Secrets Manager

Security · Est. time: 25–30 min · Cost: ⚠️ small — a KMS key is ~\$1/month and each secret is ~\$0.40/month (plus tiny API charges). Not Free Tier, but cents for a short lab. Schedule the key for deletion and delete the secret at the end.

Goal. Create a customer managed KMS key, use it to encrypt S3 objects (SSE-KMS), and store a rotating credential in Secrets Manager — making concrete the Data Protection concepts: envelope encryption, key policies, and Secrets Manager vs Parameter Store.

Step 1 — Create a customer managed KMS key

  1. KMS console → Customer managed keys → Create key.
  2. Symmetric, Encrypt and decrypt. Next.
  3. Alias lab-key. Next.
  4. Key administrators: your admin user/role. Next.
  5. Key usage permissions: same principal (so you can encrypt/decrypt). Next → Finish.
KEY_ID=$(aws kms create-key --description "lab-key" --query KeyMetadata.KeyId --output text)
aws kms create-alias --alias-name alias/lab-key --target-key-id $KEY_ID

See the key policy

Open the key → Key policy. Note the statement delegating to arn:aws:iam::<acct>:root — that's what lets your IAM permissions govern the key. Remove it and IAM policies would stop working for this key (the gotcha from Topic 2).

Step 2 — Enable automatic rotation

On the key → Key rotation tab → enable automatic rotation (default 365 days).

aws kms enable-key-rotation --key-id $KEY_ID
aws kms get-key-rotation-status --key-id $KEY_ID   # RotationEnabled: true

Rotation keeps the same key ID — old ciphertext still decrypts, no app change.

Step 3 — Use the key: SSE-KMS on S3

  1. S3 → create a bucket lab-kms-<yourname>-<random>.
  2. Properties → Default encryption → SSE-KMS → choose alias/lab-key.
  3. Upload any small file. It's now encrypted with a data key wrapped by your KMS key (envelope encryption).
BUCKET=lab-kms-$(date +%s)
aws s3 mb s3://$BUCKET
aws s3api put-bucket-encryption --bucket $BUCKET \
  --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms","KMSMasterKeyID":"alias/lab-key"}}}]}'
echo "hello" > f.txt && aws s3 cp f.txt s3://$BUCKET/
aws s3api head-object --bucket $BUCKET --key f.txt   # ServerSideEncryption: aws:kms

Step 4 — Store a secret in Secrets Manager

  1. Secrets Manager → Store a new secret → Other type of secret.
  2. Key/value e.g. password = Sup3rS3cret!. Encryption key: alias/lab-key.
  3. Name lab/db-password. (Rotation can be configured here — native for RDS/Redshift/DocumentDB via a rotation Lambda.) Store.
  4. Retrieve it: open the secret → Retrieve secret value.
aws secretsmanager create-secret --name lab/db-password \
  --secret-string '{"password":"Sup3rS3cret!"}' --kms-key-id alias/lab-key
aws secretsmanager get-secret-value --secret-id lab/db-password --query SecretString --output text

Why Secrets Manager over Parameter Store here

Secrets Manager gives built-in scheduled rotation. If you only needed a KMS-encrypted config value without rotation, a free Parameter Store SecureString would do — that's the exam distinction.

Teardown

  1. Delete the S3 objects and bucket.
  2. Secrets Manager → delete lab/db-password (there's a recovery window; choose to force-delete if you want it gone immediately).
  3. KMS → the key → Key actions → Schedule key deletion (min 7 days — you can't delete instantly; it stops billing when actually deleted). Or just disable it.
aws s3 rb s3://$BUCKET --force
aws secretsmanager delete-secret --secret-id lab/db-password --force-delete-without-recovery
aws kms schedule-key-deletion --key-id $KEY_ID --pending-window-in-days 7

✅ What you should understand now

  • A customer managed key lets you control the key policy, rotation, and audit — and the key policy is the root of access (IAM only works if it delegates).
  • SSE-KMS uses envelope encryption: your KMS key wraps per-object data keys; it never directly encrypts the bulk object.
  • Automatic rotation (365-day default) keeps the same key ID, so nothing breaks.
  • Secrets Manager = secrets with rotation; Parameter Store SecureString = free, KMS-encrypted, no native rotation.
  • KMS keys can't be deleted instantly — 7–30 day window; disable if unsure.

Related: Learn — Data Protection · Revise — Data Protection