What is AWS KMS?
AWS Key Management Service (AWS KMS) is an AWS service used to create and control cryptographic keys that can be used to protect data.
Instead of manually managing encryption keys, AWS KMS provides a centralized way to manage keys and control who can use them.
In this task, I created a symmetric KMS key and used it for both encryption and decryption.
Task Overview
The Nautilus DevOps team wanted to improve the security of sensitive data using AWS KMS.
The requirements were:
Create a symmetric KMS key named devops-KMS-Key.
Encrypt the existing SensitiveData.txt file.
Base64-decode the encrypted ciphertext.
Save the encrypted data as EncryptedData.bin.
Decrypt the encrypted file.
Verify that the decrypted content matches the original data.
Step 1: Create a Symmetric KMS Key
The first step was to create a customer-managed KMS key.
From the AWS KMS console:
AWS Console → KMS → Customer managed keys → Create key
For the key configuration, I selected:
The key was successfully created and appeared under Customer managed keys with an Enabled status.
Key Alias
devops-KMS-Key
A KMS alias makes it easier to identify and reference a key instead of working directly with the complete key ID.
Step 2: Locate the Sensitive File
The sensitive file was already available on the AWS client:
/root/SensitiveData.txt
The file contained sensitive information that needed to be encrypted before being stored or used.
Step 3: Encrypt the File Using AWS KMS
After creating the KMS key, I used the AWS CLI to encrypt the file.
The command used was:
aws kms encrypt \
--key-id eb56b040-5f4d-4161-a0c0-75addb3f24c0 \
--plaintext SensitiveData.txt \
--query CiphertextBlob \
--output text \
| base64 --decode > EncryptedData.bin
Let's understand what this command does.
aws kms encrypt
This calls the AWS KMS encryption operation.
--key-id
Specifies the KMS key used for encryption.
eb56b040-5f4d-4161-a0c0-75addb3f24c0
--plaintext
Specifies the input file that needs to be encrypted.
SensitiveData.txt
--query CiphertextBlob
The KMS encryption response contains the encrypted data inside CiphertextBlob.
--output text
Returns the result as text.
base64 --decode
The AWS CLI returns the ciphertext in Base64-encoded form, so it is decoded into its binary representation.
> EncryptedData.bin
Finally, the decoded encrypted data is saved as:
EncryptedData.bin
Step 4: Verify the Encrypted File
After running the encryption command, the encrypted file was created successfully.
EncryptedData.bin
The important point here is that the file is no longer stored as the original readable plaintext.
Instead, it contains the encrypted ciphertext generated using the KMS key.
Step 5: Decrypt the Encrypted File
Next, I tested whether the encrypted data could be successfully decrypted using the same KMS key.
The following AWS CLI command was used:
aws kms decrypt \
--ciphertext-blob fileb://EncryptedData.bin \
--query Plaintext \
--output text \
| base64 --decode > decode.txt
This command performs the reverse operation.
Step 6: Verify the Decrypted Data
Finally, I checked the decrypted file:
cat decode.txt
The output was:
This is a sensitive file.
The decrypted content matched the original SensitiveData.txt file.
Conclusion
AWS KMS provides a secure way to create and manage encryption keys without having to build a complete key management system from scratch.
In this Day 41 hands-on task, I created a symmetric KMS key named devops-KMS-Key, encrypted SensitiveData.txt, converted the returned Base64 ciphertext into EncryptedData.bin, and successfully decrypted the file again.
The final verification confirmed that the decrypted content matched the original sensitive data.
This was another useful hands-on exercise in understanding AWS Security, Encryption, AWS KMS, and DevOps security practices.
