Security and Microservice Architecture on AWS

Appendix C. Hands-On Encryption with AWS KMS

Chapter 3 talked about the importance of encryption for all the data that is stored on AWS. You can use AWS Key Management Service (KMS) to simplify the process of data encryption and to manage the encryption keys that are used to encrypt your data. In this appendix, I will give you a practical overview of the process and show you how you can encrypt your sensitive data on AWS using envelope encryption. As a reminder, envelope encryption is the process where you encrypt large amounts of data with an encryption key (called the data key) and then use AWS KMS to encrypt this data key using a key controlled by AWS Customer Master Key (CMK).

In order to work with this example, you will need the following applications installed on your computer:

• AWS Command Line Interface (CLI)

• OpenSSL toolkit

Once you have your CMK ready, let’s start using it to encrypt plaintext. In order to work with binary data, you need to encode your data with Base64. Base64 is a group of binary-to-text encoding schemes that represent binary data in an ASCII string format. Typically, Base64-encoding schemes are used when digital data needs to be encoded using algorithms that predominantly deal with text. In this way, the data will remain intact during the encryption and decryption process.

Basic Encryption Using the CMK

To transmit a message, follow these steps:

1. Create CMK on AWS. This will be the key that will be used to encrypt your data.

2. Encode your message with ...