Connecting AWS KMS with S3 - Server Side Encryption SSE

This guide provides step-by-step instructions on how to connect AWS Key Management Service (KMS) with Amazon S3 for server-side encryption (SSE).

Hafeez Baig
55 steps
6 minutes

Amazon Web Services

Refer to the following guide to learn how to use IAM in the cloud\ <https://scribehow.com/shared/Creating_an_IAM_User_and_User_Group_in_AWS_Management_Console__hWNiiXlcRJKFqYZZEJD-cg>

Sign in to **AWS Management Console** as an **IAM User** **Pre-requisite** - Ensure you have selected the AWS region closest to your location\ For this guide, we will be using us-east-2 (Ohio) as a preferred choice

Type **Key Management Service** in the search bar and click on **Key Management Service** to view the Key Management Service Dashboard

**What is AWS Key Management Service?** AWS Key Management Service (KMS) is a managed service by Amazon Web Services (AWS) for creating, controlling, and managing encryption keys used to secure data stored on AWS services and in applications.

**Key Management Service (KMS)** dashboard wizard will open, on the left bar click on the **AWS managed keys**

**What are AWS managed keys?** AWS managed keys are encryption keys automatically generated and managed by AWS Key Management Service (KMS) on behalf of AWS customers, simplifying encryption tasks for data stored in various AWS services.

**AWS managed keys** wizard will open

On the left bar click on **Customer managed keys**

**What are Customer managed keys?** Customer managed keys are encryption keys created, imported, and controlled directly by AWS customers using AWS Key Management Service (KMS), offering full lifecycle management and control over key usage and access.

**Customer managed keys** wizard will open, on the top right corner click on the **Create key** button

**Configure key** wizard will open, select the option **Symmetric**

**What is Symmetric key type?** A symmetric key is a single key used for both encryption and decryption of data in symmetric encryption algorithms, where both parties share the same secret key.

Scroll the page and click on the **Next** button

**Add labels** wizard will open, type "**my-master-key**" in text input field

Scroll the page and click on the **Next** button

**Define key administrative permissions** wizard will open, select the Names **in28minutes-ops-user** and **in28minutes_dev**

Scroll the page and click on the **Next** button

**Define key usage permissions** wizard will open, scroll to the **Key users** section and select the Names **in28minutes-ops-user** and **in28minutes_dev**

Scroll to the **Other AWS accounts** section, here you can add another AWS account by clicking on the **Add another AWS account button**

Click on the **Next** button on the right side

**Review** wizard will open, review the settings and click on the **Finish** button

**Success** Your AWS KMS key was created with alias **my-master-key**

Congratulations on the successful creation of your AWS KMS key with the alias **my-master-key**! Well done!

Type **S3** in the search bar and click on **S3** to view the S3 Dashboard

**Amazon S3** dashboard will open, on the right side click on the **Create bucket** button

**Create bucket** wizard will open, give **Bucket name** as **"my-aws-encrypted-bucket-with-kms"** in the text input field

Scroll the page and click on the **Create bucket** button

Successfully created bucket "**my-aws-encrypted-bucket-with-kms**"

Congratulations on successfully creating the bucket "**my-aws-encrypted-bucket-with-kms**"! Well done!

Scroll to the **General purpose buckets** section and click on the Name **my-aws-encrypted-bucket-with-kms**

**my-aws-encrypted-bucket-with-kms** wizard will open, click on the Properties tab

Scroll to the **Default encryption** section

**What is Default encryption in S3?** Default encryption in Amazon S3 automatically encrypts objects stored in S3 buckets using server-side encryption (SSE) without manual configuration. It offers options like SSE-S3, SSE-KMS, and SSE-C for encryption, enhancing data security at rest.

On right side click on the **Edit** button

**Edit default encryption** wizard will open, select the option **Server-side encryption with AWS Key Management Service keys (SSE-S3)**

**What is SSE-KMS (Server-Side Encryption with AWS Key Management Service)?** SSE-KMS (Server-Side Encryption with AWS Key Management Service) is a feature in Amazon S3 that encrypts data stored in S3 buckets using encryption keys managed by AWS KMS, offering enhanced security controls and centralized key management.

Scroll to the **AWS KMS key** section and select the option **Choose from your AWS KMS keys**

Scroll to the **Available AWS KMS keys** dropdown and select the **my-master-key**

Scroll the page and click on the **Save changes** button

Successfully edited default encryption

Congratulations on successfully editing the default encryption settings! Well done!

On **my-aws-encrypted-bucket-with-kms** wizard click on the **Objects** tab

Click on the **Upload** button on the right side

**Upload** wizard will open, click on the **Add files** button

**Files and Folders** wizard will open, select the object **course0.png** and click on the **Open** button

Scroll the page and click on **Upload** button

Upload succeeded

Congratulations on successfully uploading the files to the S3 bucket! Well done!

To view the **Encryption key ARN,** scroll to the **Files and folders** section and click on the Name **course0.png**

**course0.png** wizard will open, scroll to the **Server-side encryption settings** section and here you can view the **Encryption key ARN** link

To delete an Object, go back to the **my-aws-encrypted-bucket-with-kms** wizard

Scroll to the **Objects** section and select the name **course0.png**

On the right side click on the **Delete** button

**Pemanently delete objects?** wizard will open, type "**permanently delete**" in the text input field

Click on the **Delete objects** button on the right side

Successfully deleted objects

Congratulations on successfully deleting the objects! Well done!

To delete the bucket, on the left bar click on the **Buckets**

Buckets wizard will open, scroll to the **General purpose buckets** section, and select the name **my-aws-encrypted-bucket-with-kms**

On right side click on the **Delete** button

**Delete bucket my-aws-encrypted-bucket-with-kms** wizard will open, enter **my-aws-encrypted-bucket-with-kms** in the text input field and click on the **Delete bucket** button

Successfully deleted bucket **my-aws-encrypted-bucket-with-kms**

Congratulations on successfully deleting the bucket! Well done!

To **Schedule key deletion,** come back to the **Key Management Service (KMS)** dashboard tab and select the Aliases **my-master-key**

Click on the **Key actions** dropdown button and select the option **Schedule key deletion**

Scroll to the **Confirmation** section and tick the checkbox

Click on the **Schedule deletion** button on the right side

Successfully scheduled deletion for key

Congratulations on successfully scheduling the deletion for the key and completing the lab! Well done!