Securing S3 with AWS Key Management Service

Posted on November 8, 2024

AWS Security Essentials: Integrating KMS with S3

Amazon Web Services (AWS) provides robust security features to protect your data in the cloud. One of the key services in this realm is AWS Key Management Service (KMS), which seamlessly integrates with Amazon Simple Storage Service (S3) to offer enhanced data encryption capabilities. This article explores the essential aspects of KMS integration with S3 and provides a step-by-step guide on how to implement these security measures.

Understanding AWS Key Management Service

AWS KMS is a managed service designed to simplify the creation and control of encryption keys used to secure your data. It utilizes FIPS 140-2 validated hardware security modules to ensure the highest level of protection for your keys. KMS is integrated with numerous AWS services, allowing you to safeguard data across various platforms. Additionally, its integration with AWS CloudTrail and S3 provides comprehensive logs of all key usage, helping you meet regulatory and compliance requirements.

Create an Encrypted S3 Bucket

  1. From the AWS Management Console, click Services.
  2. Under Storage, click S3.
  3. Click Create Bucket.

  1. In Bucket name, set a unique bucket name.

  1. Scroll down to Default encryption and select Server-side encryption with AWS Key Management Service keys (SSE-KMS).

  2. Under AWS KMS key, select Choose from your AWS KMS keys.

  1. In Available AWS KMS keys, select the key that has AWS/S3 in its description and click Create bucket.

Upload a File to the Encrypted S3 Bucket

  1. Click the newly created bucket to open it.
  2. To the right, click Upload.
  3. Click Add files.
  4. Select a file from your local machine to upload and click Choose for Upload.
  5. Click Upload.

  1. Once the upload has succeeded, click Exit.

  2. To confirm that the file was successfully encrypted, click the file to open it.

  3. Scroll down to Server-side encryption settings. Notice that in KMS master key ARN, a master key ARN number has been created to encrypt the file from the S3 bucket.

Encrypt Two Files in S3 with Different Keys

Create a Customer Managed Key

  1. On the top main menu, click Services and select Key Management Service.

Note: If you see any error messages at the top of the page telling you that you dont’ have permissions, you can ignore those messages and close them. They won’t prevent you from being able to complete the lab.

  1. On the left menu, select Customer managed keys.
  2. Click Create key.
  3. Leave all of the default settings and click Next.
  4. In Alias, enter “my_s3_key”.
  5. Click Next > Next > Next.
  6. Click Finish.

Upload a New File and Encrypt with the Customer Managed Key

  1. Return to S3 and click the bucket to open it.
  2. To the right, click Upload.
  3. Click Add files.
  4. Select a new file from your local machine to upload and click Open.
  5. Expand Properties and scroll down to Server-side encryption.
  6. In Server-side encryption, select Specify an encryption key, then Override bucket settings for default encryption.
  7. In Encryption key type, select AWS Key Management Service key (SSE-KMS).
  8. In AWS KMS Key, select Choose from your AWS KMS keys.
  9. In Available AWS KMS keys, select the customer managed key previously created.
  10. Scroll to the bottom and click Upload.

  1. Once the upload has succeeded, click Close.

  2. To confirm that the file was successfully encrypted by the custom key, click the file to open it.

  3. Scroll down to Server-side encryption settings. Notice that in KMS master key ARN, a new master key ARN number has been created to override the S3 bucket policy.

Important Considerations

It’s crucial to note that S3 bucket encryption policies take precedence over individual folder settings within the bucket. If you require different encryption keys for specific documents, you’ll need to adjust the settings for each file individually during the upload process.

By leveraging AWS KMS integration with S3, you can ensure that your data is protected with strong encryption, both at rest and in transit. This approach not only enhances your overall security posture but also helps in maintaining compliance with various data protection regulations.