| Type | Managed by | Rotation | Cross-account | Cost |
|---|---|---|---|---|
| AWS Owned | AWS | Automatic | N/A | Free |
AWS Managed (aws/s3) | AWS | Every year (auto) | ❌ | Free |
| Customer Managed (CMK) | Customer | Configurable | ✅ | $1/month + API calls |
1. GenerateDataKey → plaintext data key + encrypted data key
2. Encrypt data locally với plaintext key
3. Lưu encrypted data key cùng encrypted data
4. Delete plaintext key from memory
Decrypt:
1. KMS Decrypt encrypted data key → plaintext data key
2. Decrypt data locally với plaintext data key
| API | Mô tả | Data Size |
|---|---|---|
Encrypt | Encrypt data trực tiếp bằng KMS key | ≤ 4KB |
Decrypt | Decrypt data | ≤ 4KB |
GenerateDataKey | Trả về plaintext + encrypted data key | For envelope encryption |
GenerateDataKeyWithoutPlaintext | Chỉ encrypted data key | Deferred encryption |
ReEncrypt | Decrypt + re-encrypt với key khác | Key rotation |
ThrottlingExceptionWithout caching: Every encrypt → KMS API call
With caching: Cache data key → reuse for multiple encrypts
KMS API có quota limits. High-throughput encryption → dùng data key caching hoặc SSE-S3 thay vì SSE-KMS.
Exam Tip: Data > 4KB = Envelope Encryption (GenerateDataKey). AWS Managed keys không share cross-account → dùng CMK. KMS throttling → data key caching.