Skip to content

AWS KMS Key

Service Name: AWS Key Management Service (KMS)

Service Description: AWS Key Management Service (KMS) is a managed service that makes it easy to create and control the encryption keys used to encrypt your data. AWS KMS integrates with other AWS services to help you protect the data you store in these services and control access to the keys that decrypt it.

Service Address: https://aws.amazon.com/kms/

Validation Type: API Auth

IP Allow list: IP Restriction is available per service using Security Groups, VPCs, and IAM conditions that can restrict access based on source IP.

Secret Access Scope: Grants ability to encrypt and decrypt data, generate data keys, and manage cryptographic operations in AWS services. Access to KMS keys is controlled through key policies and IAM policies.

Secret Revokement URL: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html

Secret Example: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

Suspicious Activity Investigation Instructions:

  • Review CloudTrail logs for unusual KMS API calls, particularly Decrypt, Encrypt, GenerateDataKey, or ReEncrypt operations.
  • Check for unauthorized key policy changes or permission modifications.
  • Monitor for unusual patterns of key usage across regions or services.
  • Investigate any KMS operations from unfamiliar IP addresses or outside normal business hours.
  • Review AWS CloudWatch metrics for spikes in KMS API usage.

Mitigation Instructions:

  • Disable the compromised KMS key by using the AWS Console or AWS CLI command: aws kms disable-key --key-id <key-id>.
  • Schedule the key for deletion (note that AWS enforces a waiting period of 7-30 days before actual deletion).
  • Rotate any compromised KMS keys using the key rotation feature.
  • Update key policies to remove unauthorized access.
  • Create new KMS keys and re-encrypt sensitive data with the new keys.
  • Enable AWS CloudTrail logging specifically for KMS operations if not already enabled.
  • Consider implementing automated monitoring for suspicious KMS activity.