KMS

Key Management Service (KMS) 100

• KMS - managed service that allows you to create and control encryption keys that will manage your data

• Customer Master Key (CMK) - this is the name of the keys that you create in KMS

  • AWS Managed CMK these are keys managed my AWS, like keys for other AWS like Lambda \

  • Customer Managed CMK _ you create, own and managae youyrslef

  • Data Key encyrotion kety to encrypt various sizes of data. amd a CMK can be used to generate, encryp[t, and decryp[t deata keyts /

• Encyrpot and Descrypt are commannds and when you encryot a fiule it replaces the unecrypoted file with an encryptoed file and then decrypting the file, these are commands that already exist you just use the CMK in order to access encyrption as well as encrypty the data based on the key, when you rotate keys, its 321

• going to un encyrpt the data witht the old key and then rencyrpt with the new key

AWS Certificate Manager (ACM) - create and manage SSL/ TLS certificats for securing websties

Envelope encryption - What is the name of the practice of encrypting plaintext data with a data key, and then encrypting the data key under another key?

re-encrypt - You need to re-encrypt a file with a new customer master key (CMK). Which API call can you use to do this?

Asymmetric KMS encryption keys cannot be rotated automatically on a yearly rotation.