1

Question # 0: AWS console displays AWS managed keys and Customer Managed Keys; it doesn't display AWS owned CMKs as an item in the list. As per documentation, customers cannot view or manage AWS-owned CMKs. However, under AWS managed keys, I see keys that were not created by me either implicitly or explicitly. Particularly I see this key with the alias aws/dynamodb. When I created DynamoDB tables, I used default settings which means, it will use AWS-owned CMKs for encryption at rest. Does this mean, "aws/dynamodb" is an AWS-owned CMK? It is a bit ambiguous. Is there a field in aws kms describe-key that displays the type?

Console

The default option in us-east-1 is AWS owned CMK

enter image description here

Question # 1: Other than rotation policy, ownership, and the cost, is there a fundamental difference in the way AWS-owned CMKs encrypt/decrypt data when compared to AWS-managed CMKs?

Question # 2: As per the documentation, AWS-owned CMK usage is not limited to one particular account, this means there is a possibility that AWS uses the same CMK across multiple different accounts Is this understanding correct?

Question # 3: What services besides DynamoDB use AWS-owned CMKs for encryption at rest? In the picture, I see some more keys, and those are corresponding services that I tried.

Appreciate any help. Thanks in advance.

4

1 回答 1

1

这是否意味着“aws/dynamodb”是 AWS 拥有的 CMK？

不会。AWS 拥有的 CMK 不会显示在您的 KMS 控制台中。这aws/dynamodb是 AWS 托管的 CMK，它不是免费的。它是 DynamoDB 表创建中的第二个选项：

在此处输入图像描述

Q1。从密码学的角度来看，没有区别，至少我不知道。但实际的区别是你不能自己使用AWS-owned CMKs。您不能使用它来使用 AWS CLI 或 SDK 解密/加密您自己的数据，因为 CMK 仅供 AWS 使用。另一个区别是在账户之间移动加密数据更容易，因为 AWS 将在两个账户上使用相同的 AWS 拥有的密钥，而不是您在不同账户上管理不同的密钥。

Q2。对，那是正确的。AWS 可以为多个客户重复使用相同的密钥。

Q3。我认为 S3 是使用 AWS 拥有的密钥SSE-S3最常见的服务。

于 2021-03-01T01:14:45.863 回答