Please enable JavaScript.

Coggle requires JavaScript to display documents.

KMS (CMK (Generate Data Keys (4kb), Data Encryption Key (GenerateDataKey…

- - - - plaintext - encrypt
        
        Discarded
        
        Encrypted stored with encrypted data
- - - - PKCS 11, JCE, CNG
        
        No HA
- - - - key in volume
        
        hypervisor decrypt
        
        IO, Snapshots, Persisted Data
  - - - Key stored in Table
        
        cached 12 hours
    - - CipherDataKey stored with obj metadata
- - - - Key Admin
        
        admin actions
        
        create
        
        describe
        
        enable
        
        list
        
        revoke
        
        1 more item...
      - Usage
        
        encrypt
        
        decrypt
        
        rencrypt
        
        gendatakey
        
        describekey
        
        1 more item...
- - - - 2500 grants per cmk
        
        5500 shared api limit
- - - - Asymmetric
        
        1/2 stored on resource
        
        other half public
    - - native integration
        
        elb/cdn/beanstalk/api gateway
        
        auto renewed certs
        
        regional
        
        never stored unencrypted