Encrypt S3 bucket, EBS Volume and AMI using AWS KMS

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​

Overview

​

Lab details

1. This lab walks you through creating a Custom AWS Key Management Service (AWS KMS).
2. You will practice this lab by encrypting and verifying different services like S3, EBS Volume, AMI, etc.
3. Duration: 1 hour 30 minutes
4. AWS Region: US East (N. Virginia) us-east-1

​

Introduction

Amazon Web Services (AWS) Key Management Service (KMS) is a fully managed encryption service that allows you to create and control the encryption keys used to protect your data and workloads within the AWS ecosystem. It provides a central way to manage cryptographic keys for various AWS services and your own applications. AWS KMS makes it easy to create and manage encryption keys, and it offers a range of features and integrations to enhance the security of your data. AWS KMS is a critical service for securing sensitive data and ensuring compliance with encryption and key management requirements. It simplifies the process of key management, which can be complex and error-prone if implemented manually. Here are some key features and aspects of AWS KMS:

• Key Creation and Management: AWS KMS allows you to create and manage cryptographic keys. You can create and rotate keys to ensure data security.
• Integration with AWS Services: KMS seamlessly integrates with many AWS services, such as Amazon S3, Amazon RDS, Amazon EBS, and more. You can use KMS keys to encrypt data stored in these services.
• Envelope Encryption: KMS uses envelope encryption, where data is encrypted with a data key, and that data key is encrypted with a master key managed by KMS. This provides an additional layer of security.
• Key Policies and Access Control: You can define access policies to control who can use your keys. This allows you to restrict access to only authorized users and services.
• Logging and Monitoring: AWS KMS provides extensive logging and monitoring through AWS CloudTrail and AWS CloudWatch, allowing you to track key usage and detect suspicious activity.
• Custom Key Store: You can use AWS CloudHSM to create custom key stores for added control over your keys. This is useful for compliance and regulatory requirements.
• Regional Service: AWS KMS operates within specific AWS regions. Each region has its own KMS service, which helps in ensuring data locality and compliance with regional data privacy laws.

​

Architecture diagram

​

Task details

1. Sign in to AWS Management Console.
2. Creating an AWS KMS Key
3. Enable AWS KMS Master Key rotation.
4. Creating and encrypting S3 Bucket.
5. Encrypting and uploading an object to S3 Bucket.
6. Verifying the encryption of the object.
7. Cross Region Replication and Versioning in S3
8. Disabling the KMS Key.
9. Encrypting EBS Volume.
10. Encrypting AMI and Snapshot.
11. Validation of the Lab
12. Deleting AWS Resources.

​

Launching the lab environment

1. To launch the lab environment, Click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
   • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
   • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​

Task 2: Creating an AWS KMS Key

1. Make sure you are in the US East (N. Virginia) us-east-1 Region.
2. Navigate to Key Management Service by clicking on the Services menu, under the Security, Identity and Compliance section.
3. Click on Create Key.

Note: Ignore, if any other customer-managed keys present in the account. It will take some time to delete the keys.

4. Select the Key Type as Symmetric and click on Next.
5. Under the Add Labels, give the following details:
   • Alias: Enter Whizkey (Change the name, if there is a key present with the same name)
   • Description: KMS key for encryption
   • Leave everything else as default
   • Click on Next.
6. In the Define key administrative permissions,
   • Key Administrators: Select the IAM Role, with which you are logged in (starting with WhizlabsLabStudentRole)
   • Check the Allow key administrators to delete the key
   • Click on Next
7. In the Define key usage permissions,
   • This account: Select the same role selected earlier.
   • Click on Next.
8. Review the details and click on Finish button.

​

Task 3: Enabling KMS Key rotation

1. Click the created alias Whizkey.
2. Navigate to the Key material and rotations tab.
3. Now, check the box for Automatically rotate. To do this, click Edit, then select Enable. In the Rotation period (in days) field, enter 365, and finally, click Save.

4. You have now successfully enabled yearly rotation for your KMS master key.
5. When automatic key rotation is enabled, KMS generates new cryptographic material every 365 days and retains the older cryptographic material (old key).In this way, both keys can be used to encrypt or decrypt data.

​

Task 4: Creating and encrypting S3 Bucket

1. Navigate to S3 by clicking on the Services menu, under the Storage section.
2. Click on Create Bucket.
3. Region: Select US East (N. Virginia) us-east-1 (i.e same region as the KMS master key)
4. In the General Configuration,

• Bucket type : General purpose
• Bucket name: Enter a globally unique name.

5. Object ownership: Select ACLs enabled option and select Object Ownership as Object Writer
6. In the Bucket Public Access settings for this bucket, Uncheck the Block all public access. Acknowledge the same by Checking the below option.

7. In the Bucket Versioning, Check the option Enable.

8. In the Default encryption,

• Encryption key type: Select AWS Key Management Service key (SSE-KMS)
• AWS KMS key: Select Choose from your AWS KMS keys
• Select Whizkey from the dropdown menu.

9. Keep other settings as default and click on Create Bucket.
10. whizsource123 bucket is created now.

​

Task 5: Encrypting and uploading an object to S3 Bucket

1. Click on the whizsource123.
2. Click on the Upload button.
3. Click on the Add Files button and browse for a file(image or text) on your local machine.
4. Before clicking on Upload, scroll down and expand the Properties tab
5. Select the following details:

• Storage class: Select One Zone-IA
• Server-side encryption: Select Specify an encryption key
• Encryption settings: Choose Override default encryption bucket settings
• Encryption key type: Select AWS Key Management Service key (SSE-KMS)
• AWS KMS key: Select Choose from your AWS KMS keys
• Select Whizkey from the dropdown menu.
• Leave other settings as default and click on the Upload button.
• Click on the Close button.

​

Task 6: Verifying the encryption of the object

1. Now let us check whether the encryption is working.
2. Select the object you have uploaded.
3. Click on Actions, scroll down and select Make public using ACL.
4. Choose Make Public and click on the Close button.
5. Click the object. Copy the Object URL and paste the URL on a new browser tab.

Note: You are getting this error as the file is encrypted using AWS KMS Encryption and is restricting the access from outside source. To access this file it should be decrypted first.

6. Click the object, and click on the Open button on the top-right corner.

7. Now you can see the object which you uploaded opened in a new tab.

Note: You are able to access the file as the request to open the file came from a source which can decrypt the file.

​

Task 7: Cross-Region Replication and Versioning in S3

1. We already have a bucket whizsource123 (Source bucket) which we will use as the source bucket from where the data will be replicated. Now we need to create a bucket that will replicate the data from the source bucket.
2. Change Region: From the drop down please Select Asia Pacific (Mumbai) ap-south-1
3. Navigate to the S3 dashboard and click on Create Bucket.
4. In the General Configuration, Bucket name: Enter a globally unique name.

5. In the Bucket Public Access settings for this bucket, Uncheck the Block all public access. Acknowledge the same by Checking the below option.
6. In the Bucket Versioning, Check the option Enable.

7. Keep other settings as default and click on Create Bucket.
8. Now open the whizsource123 bucket and click on the Management tab**.** Scroll down and select Create Replication rule
9. Enter a rule name, Whizrule1, and keep the status as Enabled.

9. Choose a rule scope : Select Apply to all objects in the bucket
10. Under Destination, select choose a bucket in this account and click on Browse S3.
11. In the search option enter the Mumbai region bucket name, choose by browse the S3 option.

12. Select the target bucket created earlier and click on Choose Path.
13. Under IAM Role, Choose from existing IAM roles: select whiz_s3_role<random.numbers>
14. Under Encryption, check Replicate objects encrypted with AWS KMS and select the alias aws/s3.
15. AWS KMS key for encrypting destination object: Select Choose from your AWS KMS keys
16. Select aws/s3 from the dropdown menu.
17. Leave other settings as default. Review and click on Save.
18. When, prompted click on the cancel button.
19. Now navigate to the source bucket and upload an object in the Source bucket by clicking on Add Files. Click on Upload.
20. Navigate to your Target Bucket to see the replication. It may take up to 3-5 minutes for replication.

Note: You can see that the object from the source bucket has not been replicated, as the source and destination buckets have different encryption. Source bucket has Whizkey(Customer managed key) encryption and the destination bucket has aws/s3(AWS Managed) encryption.

21. Now go to whizsource123 bucket and click on Add files. Before clicking on the Upload button, scroll down and click on the Properties option.
22. Choose the option to specify an encryption key and choose Override default encryption bucket settings.
23. Now in the Encryption key type, choose Amazon S3 key (SSE-S3).
24. Click on Upload.

25. Now you have successfully configured the Cross-Region Replication in S3 Bucket and the object created in whizsource123 will be replicated to whiztarget123.
26. Navigate to the target bucket and refresh. You will be able to see the replicated object.
27. Click the object and select Open to see the object in the target bucket.

​

Task 8: Disabling the KMS Key

1. Make sure you are in the US East (N.Virginia) us-east-1 Region.
2. Navigate to Key Management Service by clicking on the Services menu, under the Security, Identity and Compliance section.
3. Select the alias Whizkey.
4. Click on Key actions and select Disable.
5. Check the confirmation and click on Disable Key.
6. Navigate to the Services section and click on S3 under Storage
7. Click on whizsource123 and click on the object other than the one uploaded recently (since we have Amazon S3 master key for the recently uploaded object).
8. Click Open on the top right side of the screen.

You can see that access is denied as the KMS Key is disabled.

9. Navigate back to Key Management Service and enable Whizkey by clicking on the alias Whizkey and click on Enable in the Key actions.

​

Task 9: Encrypting EBS volume

1. Make sure you are in the US East (N. Virginia) us-east-1 Region.
2. Navigate to EC2 by clicking on the Services menu, under the Compute section.
3. On the left navigation panel, click on Volumes under Elastic Block Store.
4. Click on Create Volume.
5. In the Create volume,

• Volume Type: Select General Purpose SSD(gp2)
• Size: Change to 1 GiB
• Availability Zone: Choose us-east-1a
• Encryption: Check
• Key: Choose Whizkey from the list.
• Tags:
  • Key: Enter Name
  • Value: Enter WhizEBS
• Click on Create Volume and Close.

6. Now we can see WhizEBS created. Select WhizEBS and under description, we can see that the volume is encrypted.
7. Your master key is used to encrypt/decrypt this volume.

​

Task 10: Encrypting AMI and Snapshot

1. On the left navigation panel, click on Instances.
2. You can see an EC2 instance already running.
3. Select the instance, click on the Actions, and select Create Image under Image and Templates.
4. Create Image

• Image name: Enter WhizUnencrypted
• Leave everything else as default and click on Create Image.

5. On the left navigation panel, click on AMIs under Images.
6. Select WhizUnencrypted and wait till the status changes to available.
7. Click on the Actions button and select Copy AMI.
8. Fill in the details:

• Name: Change the name to WhizEncrypted
• Destination region: Choose US East (N. Virginia)
• Encrypt EBS snapshots of AMI copy: Check
• KMS key: Select Whizkey
• Click on Copy AMI.

9. Refresh the page to see the copied AMI. Wait till the status of the AMI becomes available.
10. Select the copied AMI i.e WhizEncrypted and copy the AMI ID from the details tab.
11. On the left navigation panel, click on Snapshots under Elastic Block Store.
12. In the search, paste and search the AMI ID.
13. Wait for the snapshot status to change from pending to completed.
14. Select the snapshot and check the description tab to see that the snapshot is encrypted using Whizkey.

Note: Now any instance launched with encrypted AMI will be encrypted by Whizkey.

​

Task 11 : Validation of the Lab

1. Once the lab steps are completed, please click on the Check my work button on the left side panel.
2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
3. Sample output :

​

Do you know?

Key Rotation: AWS KMS supports automatic key rotation to enhance security by regularly changing encryption keys.

​

Task 12: Delete AWS Resources

Scheduling KMS Master Key Deletion

1. Make sure you are in the US East (N. Virginia) us-east-1 Region.
2. Navigate to Key Management Service by clicking on the Services menu, under the Security,Identity and Compliance section.
3. Select Whizkey, click on the Key actions button, and click Schedule key deletion.
4. Schedule key deletion

• Waiting period: 7 days
• Check confirmation for deletion.
• Click on Schedule deletion.

Deleting AMIs

1. Make sure you are in the US East (N. Virginia) us-east-1 Region.
2. Navigate to EC2 by clicking on the Services menu, under the Compute section.
3. On the left navigation panel, click on AMIs under Images.
4. Select WhizUnencrypted and WhizEncrypted AMIs and click on Actions button
5. Select Deregister AMI from the dropdown menu and click on Deregister AMI.

Deleting Snapshots

1. On the left navigation panel, click on Snapshots under Elastic Block Store.
2. Remove the AMI ID if present in the search.
3. Select both snapshots and click on the Actions button
4. Click on Delete Snapshot and confirm by entering delete and click on Delete

Deleting EC2 Instance

1. Click on Instances on the left side panel
2. Select the instance, click on Instance state and then click on Terminate Instance
3. In the pop-up screen, click on Terminate to delete the EC2.

​

Completion and conclusion

1. You have created KMS Key and enabled key rotation.
2. You have created Cloudtrail and accessed the logs.
3. You have encrypted S3 buckets and created cross-region replication.
4. You have encrypted EBS Volume and AMI.
5. You have scheduled the deletion of KMS Master Key.

​

End lab

1. Sign out of the AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on End lab in the IP Lab Portal and wait till the process gets completed.

​

What gets checked

When you press Check my work, the platform verifies each of these:

• Create KMS Customer Managed Key — Check whether Customer managed key created or not
• Create a S3 Replication rule — Check whether a S3 replication rule with destination bucket name is created or not.
• Create EBS Volume — Check whether an EBS volume is created.

​

Related help

• FAQs and Troubleshooting