> ## Documentation Index
> Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Encrypt S3 bucket, EBS Volume and AMI using AWS KMS
> Hands-on lab ยท 30m
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console.
Open IP Lab Portal
## Overview
### Lab details
1. This lab walks you through creating a Custom AWS Key Management Service (AWS KMS).
2. You will practice this lab by encrypting and verifying different services like S3, EBS Volume, AMI, etc.
3. Duration: **1 hour 30 minutes**
4. AWS Region: **US East (N. Virginia) us-east-1**
### Introduction
Amazon Web Services (AWS) Key Management Service (KMS) is a fully managed encryption service that allows you to create and control the encryption keys used to protect your data and workloads within the AWS ecosystem. It provides a central way to manage cryptographic keys for various AWS services and your own applications. AWS KMS makes it easy to create and manage encryption keys, and it offers a range of features and integrations to enhance the security of your data.
AWS KMS is a critical service for securing sensitive data and ensuring compliance with encryption and key management requirements. It simplifies the process of key management, which can be complex and error-prone if implemented manually.
Here are some key features and aspects of AWS KMS:
* **Key Creation and Management:** AWS KMS allows you to create and manage cryptographic keys. You can create and rotate keys to ensure data security.
* Integration with AWS Services: KMS seamlessly integrates with many AWS services, such as Amazon S3, Amazon RDS, Amazon EBS, and more. You can use KMS keys to encrypt data stored in these services.
* **Envelope Encryption:** KMS uses envelope encryption, where data is encrypted with a data key, and that data key is encrypted with a master key managed by KMS. This provides an additional layer of security.
* **Key Policies and Access Control:** You can define access policies to control who can use your keys. This allows you to restrict access to only authorized users and services.
* **Logging and Monitoring**: AWS KMS provides extensive logging and monitoring through AWS CloudTrail and AWS CloudWatch, allowing you to track key usage and detect suspicious activity.
* **Custom Key Store:** You can use AWS CloudHSM to create custom key stores for added control over your keys. This is useful for compliance and regulatory requirements.
* **Regional Service:** AWS KMS operates within specific AWS regions. Each region has its own KMS service, which helps in ensuring data locality and compliance with regional data privacy laws.
### Architecture diagram
### Task details
1. Sign in to AWS Management Console.
2. Creating an AWS KMS Key
3. Enable AWS KMS Master Key rotation.
4. Creating and encrypting S3 Bucket.
5. Encrypting and uploading an object to S3 Bucket.
6. Verifying the encryption of the object.
7. Cross Region Replication and Versioning in S3
8. Disabling the KMS Key.
9. Encrypting EBS Volume.
10. Encrypting AMI and Snapshot.
11. Validation of the Lab
12. Deleting AWS Resources.
### Launching the lab environment
1. To launch the lab environment, Click on the **Launch lab** button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with **IAM user name**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**.
You can only start one lab at any given time
## Lab guide
### Lab steps
#### Task 1: Sign in to AWS Management Console
1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
* Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
* Now copy your **User Name** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign in** button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as **US East (N. Virginia) us-east-1.**
#### Task 2: Creating an AWS KMS Key
1. Make sure you are in the **US East (N. Virginia) us-east-1** Region.
2. Navigate to **Key Management Service** by clicking on the **Services** menu, under the **Security, Identity and Compliance** section.
3. Click on **Create Key**.
**Note:** Ignore, if any other customer-managed keys present in the account. It will take some time to delete the keys.
4. Select the **Key Type** as **Symmetric** and click on **Next**.
5. Under the **Add Labels**, give the following details:
* **Alias**: Enter **Whizkey** (Change the name, if there is a key present with the same name)
* Description: **KMS key for encryption**
* Leave everything else as default
* Click on **Next**.
6. In the **Define key administrative permissions**,
* Key Administrators: Select the IAM Role, with which you are logged in (starting with **WhizlabsLabStudentRole**)
* Check the **Allow key administrators to delete the key**
* Click on **Next**
7. In the **Define key usage permissions**,
* This account: Select the same role selected earlier.
* Click on **Next**.
8. Review the details and click on **Finish** button.
#### Task 3: Enabling KMS Key rotation
1. Click the created alias **Whizkey.**
2. Navigate to the **Key material and rotations** tab.
3. Now, check the box for **Automatically rotate**. To do this, click **Edit**, then select **Enable**. In the **Rotation period (in days)** field, enter 365, and finally, click **Save.**
4. You have now successfully enabled yearly rotation for your KMS master key.
5. When automatic key rotation is enabled, KMS generates new cryptographic material every 365 days and retains the older cryptographic material (old key).In this way, both keys can be used to encrypt or decrypt data.
#### Task 4: Creating and encrypting S3 Bucket
1. Navigate to **S3** by clicking on the **Services** menu, under the **Storage** section.
2. Click on **Create Bucket**.
3. Region: Select **US East (N. Virginia) us-east-1** (i.e same region as the KMS master key)
4. In the General Configuration,
* Bucket type : **General purpose**
* Bucket name: Enter a **globally unique name**.
5. Object ownership: Select **ACLs enabled** option and select Object Ownership as **Object Writer**
6. In the **Bucket Public Access settings for this bucket**, **Uncheck** the **Block all public access**. Acknowledge the same by Checking the below option.
7. In the **Bucket Versioning,** Check the option **Enable.**
8. In the Default encryption,
* **Encryption key type**: Select **AWS Key Management Service key (SSE-KMS)**
* **AWS KMS key**: Select **Choose from your AWS KMS keys**
* Select **Whizkey** from the dropdown menu.
9. Keep other settings as default and click on **Create Bucket**.
10. **whizsource123** bucket is created now.
#### Task 5: Encrypting and uploading an object to S3 Bucket
1. Click on the **whizsource123**.
2. Click on the **Upload** button.
3. Click on the **Add Files** button and browse for a file(image or text) on your local machine.
4. Before clicking on **Upload**, scroll down and expand the **Properties** tab
5. Select the following details:
* **Storage class**: Select **One Zone-IA**
* **Server-side encryption**: Select **Specify an encryption key**
* Encryption settings: Choose **Override default encryption bucket settings**
* **Encryption key type**: Select **AWS Key Management Service key (SSE-KMS)**
* AWS KMS key: Select **Choose from your AWS KMS keys**
* Select **Whizkey** from the dropdown menu.
* Leave other settings as default and click on the **Upload** button.
* Click on the **Close** button.
#### Task 6: Verifying the encryption of the object
1. Now let us check whether the encryption is working.
2. Select the object you have uploaded.
3. Click on **Actions**, scroll down and select **Make public using ACL.**
4. Choose **Make Public** and click on the **Close** button.
5. Click the object. Copy the **Object URL** and paste the URL on a new browser tab.
**Note:** You are getting this error as the file is encrypted using AWS KMS Encryption and is restricting the access from outside source. To access this file it should be decrypted first.
6. Click the object, and click on the **Open** button on the top-right corner.
7. Now you can see the object which you uploaded opened in a new tab.
**Note:** You are able to access the file as the request to open the file came from a source which can decrypt the file.
#### Task 7: Cross-Region Replication and Versioning in S3
1. We already have a bucket **whizsource123 (Source bucket)** which we will use as the source bucket from where the data will be replicated. Now we need to create a bucket that will replicate the data from the source bucket.
2. Change Region: From the drop down please Select **Asia Pacific (Mumbai) ap-south-1**
3. Navigate to the **S3** dashboard and click on **Create Bucket**.
4. In the General Configuration, Bucket name: Enter a **globally unique name**.
5. In the **Bucket Public Access settings for this bucket**, **Uncheck** the **Block all public access**. Acknowledge the same by Checking the below option.
6. In the **Bucket Versioning,** Check the option **Enable.**
7. Keep other settings as default and click on **Create Bucket**.
8. Now open the **whizsource123** bucket and click on the **Management** tab\*\*.\*\* Scroll down and select **Create Replication rule**
9. Enter a rule name, **Whizrule1,** and keep the status as **Enabled**.
9. Choose a rule scope : Select **Apply to all objects in the bucket**
10. Under Destination, select **choose a bucket in this account** and click on **Browse S3**.
11. In the search option enter the **Mumbai region bucket name**, choose by browse the S3 option.
12. Select the target bucket created earlier and click on **Choose Path**.
13. Under IAM Role, Choose from existing IAM roles: select **whiz\_s3\_role\**
14. Under Encryption, check **Replicate objects encrypted with AWS KMS** and select the alias **aws/s3**.
15. AWS KMS key for encrypting destination object: Select **Choose from your AWS KMS keys**
16. Select **aws/s3** from the dropdown menu.
17. Leave other settings as default. Review and click on **Save**.
18. When, prompted click on the **cancel** button.
19. Now navigate to the source bucket and upload an object in the **Source bucket** by clicking on Add Files. Click on **Upload**.
20. Navigate to your **Target Bucket** to see the replication. It may take **up to 3-5 minutes** for replication.
**Note: You can see that the object from the source bucket has not been replicated, as the source and destination buckets have different encryption. Source bucket has Whizkey(Customer managed key) encryption and the destination bucket has aws/s3(AWS Managed) encryption.**
21. Now go to **whizsource123** bucket and click on **Add files.** Before clicking on the Upload button, scroll down and click on the **Properties** option.
22. Choose the option to **specify an encryption key** and choose **Override default encryption bucket settings**.
23. Now in the **Encryption key type**, choose **Amazon S3 key (SSE-S3)**.
24. Click on **Upload**.
25. Now you have successfully configured the Cross-Region Replication in S3 Bucket and the object created in **whizsource123** will be replicated to **whiztarget123**.
26. Navigate to the target bucket and refresh. You will be able to see the replicated object.
27. Click the object and select **Open** to see the object in the target bucket.
#### Task 8: Disabling the KMS Key
1. Make sure you are in the **US East** (**N.Virginia) us-east-1** Region.
2. Navigate to **Key Management Service** by clicking on the **Services** menu, under the **Security, Identity and Compliance** section.
3. Select the alias **Whizkey.**
4. Click on **Key actions** and select **Disable**.
5. Check the confirmation and click on **Disable Key.**
6. Navigate to the **Services** section and click on **S3** under **Storage**
7. Click on **whizsource123** and click on the object other than the one uploaded recently (since we have Amazon S3 master key for the recently uploaded object).
8. Click **Open** on the top right side of the screen.
**You can see that access is denied as the KMS Key is disabled.**
9. Navigate back to **Key Management Service** and enable **Whizkey** by clicking on the alias **Whizkey** and click on **Enable** in the **Key actions.**
#### Task 9: Encrypting EBS volume
1. Make sure you are in the **US East (N. Virginia) us-east-1** Region.
2. Navigate to **EC2** by clicking on the **Services** menu, under the **Compute** section.
3. On the left navigation panel, click on **Volumes** under **Elastic Block Store**.
4. Click on **Create Volume.**
5. In the **Create volume**,
* **Volume Type**: Select **General Purpose SSD(gp2)**
* **Size**: Change to **1 GiB**
* **Availability Zone**: Choose **us-east-1a**
* **Encryption**: **Check**
* **Key**: Choose **Whizkey** from the list.
* **Tags**:
* **Key**: Enter **Name**
* **Value**: Enter **WhizEBS**
* Click on **Create Volume** and **Close**.
6. Now we can see **WhizEBS** created. Select **WhizEBS** and under description, we can see that the volume is **encrypted**.
7. Your master key is used to encrypt/decrypt this volume.
#### Task 10: Encrypting AMI and Snapshot
1. On the left navigation panel, click on **Instances**.
2. You can see an EC2 instance already running.
3. Select the instance, click on the **Actions,** and select **Create Image** under **Image and Templates.**
4. Create Image
* **Image name**: Enter **WhizUnencrypted**
* Leave everything else as default and click on **Create Image.**
5. On the left navigation panel, click on **AMIs** under **Images**.
6. Select **WhizUnencrypted** and wait till the status changes to **available.**
7. Click on the **Actions** button and select **Copy AMI.**
8. Fill in the details:
* **Name**: Change the name to **WhizEncrypted**
* **Destination region**: Choose **US East (N. Virginia)**
* **Encrypt EBS snapshots of AMI copy**: Check
* **KMS key**: Select **Whizkey**
* Click on **Copy AMI**.
9. Refresh the page to see the copied AMI. Wait till the status of the AMI becomes **available**.
10. Select the copied AMI i.e **WhizEncrypted** and copy the **AMI ID** from the details tab.
11. On the left navigation panel, click on **Snapshots** under **Elastic Block Store**.
12. In the search, paste and search the **AMI ID**.
13. Wait for the snapshot status to change from **pending** to **completed**.
14. Select the snapshot and check the description tab to see that the snapshot is encrypted using **Whizkey**.
**Note:** Now any instance launched with encrypted AMI will be encrypted by **Whizkey.**
#### Task 11 : Validation of the Lab
1. Once the lab steps are completed, please click on the **Check my work** button on the left side panel.
2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
3. Sample output :
> #### Do you know?
>
> **Key Rotation:** AWS KMS supports automatic key rotation to enhance security by regularly changing encryption keys.
#### Task 12: Delete AWS Resources
##### Scheduling KMS Master Key Deletion
1. Make sure you are in the **US East (N. Virginia) us-east-1** Region.
2. Navigate to **Key Management Service** by clicking on the **Services** menu, under the **Security,Identity and Compliance** section.
3. Select **Whizkey**, click on the **Key actions** button, and click **Schedule key deletion.**
4. Schedule key deletion
* Waiting period: **7** days
* Check confirmation for deletion.
* Click on **Schedule deletion.**
##### Deleting AMIs
1. Make sure you are in the **US East (N. Virginia) us-east-1** Region.
2. Navigate to **EC2** by clicking on the **Services** menu, under the **Compute** section.
3. On the left navigation panel, click on **AMIs** under **Images**.
4. Select **WhizUnencrypted** and **WhizEncrypted** AMIs and click on **Actions** button
5. Select **Deregister AMI** from the dropdown menu and click on **Deregister AMI.**
##### Deleting Snapshots
1. On the left navigation panel, click on **Snapshots** under **Elastic Block Store**.
2. Remove the AMI ID if present in the search.
3. Select both snapshots and click on the **Actions** button
4. Click on **Delete Snapshot** and confirm by entering **delete** and click on **Delete**
##### Deleting EC2 Instance
1. Click on **Instances** on the left side panel
2. Select the instance, click on **Instance state** and then click on **Terminate Instance**
3. In the pop-up screen, click on **Terminate** to delete the EC2.
### Completion and conclusion
1. You have created KMS Key and enabled key rotation.
2. You have created Cloudtrail and accessed the logs.
3. You have encrypted S3 buckets and created cross-region replication.
4. You have encrypted EBS Volume and AMI.
5. You have scheduled the deletion of KMS Master Key.
### End lab
1. Sign out of the AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on **End lab** in the IP Lab Portal and wait till the process gets completed.
## What gets checked
When you press **Check my work**, the platform verifies each of these:
* **Create KMS Customer Managed Key** โ Check whether Customer managed key created or not
* **Create a S3 Replication rule** โ Check whether a S3 replication rule with destination bucket name is created or not.
* **Create EBS Volume** โ Check whether an EBS volume is created.
## Related help
* [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)