[ SRE_ARENA ]
← BACK TO ROADMAP
ENCRYPTION & SECRETS

Encryption & Secrets: KMS & Secrets Manager

DOWNLOADING CONCEPT: 1. THE KEY MANAGEMENT SERVICE (KMS)...

↳Encryption at Rest means that if a rogue employee unplugs a hard drive from the AWS datacenter and takes it home, they can't read the data.

AWS KMS
  • ↳is the root of trust in AWS.
  • ↳It creates and manages cryptographic keys.
  • ↳Because KMS uses specialized hardware security modules (HSMs), no one—not even AWS engineers—can extract the plaintext master keys from the service.
  • ↳You use IAM policies to explicitly grant your microservices permission to ask KMS to encrypt or decrypt data.
▲ LIVE INCIDENTA developer complains that their Lambda function is failing with an AccessDeniedException when trying to read a database password from Secrets Manager.
sre@arena:~/cloud-security
sre@arena:~$ aws iam get-role-policy --role-name LambdaExecutionRole --policy-name SecretsAccess