Customer Master Key

5 minutes 5 Questions

A Customer Master Key (CMK) is a logical representation of a master key in AWS KMS. It can be used to encrypt and decrypt data, as well as to generate and manage data keys. CMKs can be created either by the AWS KMS service or by the customer themselves. When a customer creates a CMK, they have full control over its use, including the ability to enable key rotation, manage access policies, and audit key usage. CMKs can be stored in AWS KMS or imported from an external source.

Guide: AWS Customer Master Key (CMK) - Importance, Function & Exam Tips

Why is it important:
The AWS Customer Master Key (CMK) is crucial for securing your applications and sensitive data. It is a logical representation of a master key which is used to encrypt and decrypt up to 4 KB of data and to generate, encrypt, and decrypt the data keys. Ensuring the secure management of these keys, therefore, is fundamentally significant.

What is it:
AWS Customer Master Key (CMK) is a service offered by AWS to control encryption key management centrally. It is a cryptographic key stored securely in AWS Key Management Service (KMS) hardware security modules (HSMs).

How it works:
When an application requests AWS to perform an encryption or decryption function, the request is redirected to the KMS. The Customer Master Key is then used to either facilitate decryption or encryption of data keys, key material import, or generate data keys.

Exam tips - Answering questions on Customer Master Key:
1. Understand the core functionalities of CKM, such as encryption, decryption, and the generation of data keys.
2. Familiarize yourself with AWS KMS's high-level security provisions such as hardware isolated key storage.
3. Make sure you're aware of how to rotate, disable, and re-enable CMKs.
4. Discover how AWS audits CMK usage using AWS CloudTrail.
5. Remember that CMKs are never exported from the KMS by AWS (so if you see this on a test, it's a trick question!).

Test mode:

Exam (Timed)

Practice (With explanations)

Start practice test

Question 1

You're using AWS KMS to manage Customer Master Keys (CMKs) for your application. However, only certain employees should be able to view, and manage the CMKs. Which AWS service should you use to restrict access to specific users?

AWS Organizational Units (OUs) AWS Resource Access Manager AWS CloudTrail AWS Identity and Access Management (IAM)

Correct Answer: AWS Identity and Access Management (IAM)

AWS Identity and Access Management (IAM) allows you to create and manage users, groups, roles, and permissions in your AWS environment. With IAM, you can control who can access KMS, allowing only specific users to view, and manage your CMKs.

Question 2

You are dealing with sensitive financial data for your application. Given security and compliance requirements, it's crucial to encrypt the data before storing it on Amazon S3. Which of the following services would you use to create and manage the Customer Master Key (CMK) used for encrypting those objects?

AWS Key Management Service (KMS) AWS CloudHSM AWS Secrets Manager AWS Identity and Access Management (IAM)

Correct Answer: AWS Key Management Service (KMS)

AWS Key Management Service (KMS) provides an easy way to create, manage, and use cryptographic keys called Customer Master Keys (CMKs). These CMKs can be used with other AWS services like Amazon S3 that support integrating with KMS.

Question 3

You have AWS CloudTrail enabled in your AWS account to log all usage of the Customer Master Keys in AWS KMS. What information should you expect to find in the CloudTrail logs?

API calls/events containing metadata about the key usage Key material such as the actual key value IAM permissions and policies Encrypted data

Correct Answer: API calls/events containing metadata about the key usage

AWS CloudTrail logs API calls/events pertaining to various AWS services, including AWS KMS. The logs will contain metadata about the key usage, such as who used the key, for what purpose, and when. CloudTrail, however, will not log actual key material, encrypted data or any unrelated aspects like IAM permissions or policies.

Go Premium