AWS KMS Tutorial: Master Key Management for Enterprise Security

AWS managed keys (aws/s3, aws/ebs, etc.) don't provide the granular control required for CMMC compliance. You cannot control key policies, rotation schedules, or cross-account access—all requirements for Level 2 and Level 3 certification.

Default key policies often grant broad permissions using wildcards or allow unrestricted IAM access. This violates the principle of least privilege and can expose sensitive data to unauthorized users within your account.

NIST SP 800-171 requires regular key rotation for CUI protection. Manual rotation is error-prone and doesn't meet the continuous monitoring requirements for CMMC Level 3 certification.

Without proper CloudTrail integration and monitoring, you cannot demonstrate compliance with key usage requirements or detect unauthorized access attempts—an automatic CMMC failure.

Prerequisites:

• AWS account with KMS full access permissions
• AWS CLI configured with appropriate credentials
• Understanding of your data classification levels (FCI vs CUI)
• CloudTrail enabled for audit logging

Console Steps:

1.1 Navigate to AWS KMS Console

• Go to https://console.aws.amazon.com/kms/
• Click "Customer managed keys" in the left navigation
• Click "Create key" button

1.2 Configure Key Specifications

• Key type: Symmetric (for most encryption use cases)
• Key usage: Encrypt and decrypt
• Key spec: SYMMETRIC_DEFAULT
• Regionality: Single-Region key (for CMMC compliance)
• Click "Next"

1.3 Add Key Metadata

• Alias: alias/cmmc-cui-encryption-2025
• Description: CMMC Level 3 compliant key for CUI encryption - Created [DATE]
• Tags:
• Environment: Production
• DataClassification: CUI
• CMMCLevel: Level3
• Owner: Security Team
• Project: CMMC-Compliance
• Click "Next"

1.4 Define Key Administrative Permissions

• Key administrators: Select specific IAM users/roles (NOT root)
• Enable "Allow key administrators to delete this key"
• Recommended administrators:
• Security team lead IAM role
• KMS administrator role
• Break-glass emergency access role
• Click "Next"

1.5 Define Key Usage Permissions

• Select specific IAM users and roles that need to encrypt/decrypt data
• Enable "Allow use of the key in cryptographic operations for these users"
• Do NOT select "Allow attachment of persistent grants"
• Click "Next"

1.6 Review and Create

• Review the auto-generated key policy
• Ensure no wildcard (*) permissions exist
• Verify the key policy includes specific principals
• Click "Finish" to create the key

Key policies are the primary access control mechanism for KMS keys. For CMMC compliance, policies must implement strict access controls, condition-based restrictions, and comprehensive auditing.

Console Steps:

2.1 Access Key Policy Editor

• In the KMS console, click on your newly created key
• Go to the "Key policy" tab
• Click "Switch to policy view" for advanced editing

2.2 Implement CMMC-Compliant Key Policy

2.3 Set Encryption Context Requirements

• Always require encryption context for CUI data
• Standard context keys:
• DataClassification: CUI, FCI, or UNCLASSIFIED
• Environment: Production, Staging, Development
• Application: Application name or ID
• Owner: Data owner or team

2.4 Validate Policy Syntax

• Click "Save changes" to validate JSON syntax
• Test key access using AWS CLI:

Automated key rotation is required for CMMC Level 2+ compliance and follows NIST SP 800-171 guidelines for cryptographic key management.

Console Steps:

3.1 Enable Automatic Key Rotation

• In your KMS key details, go to the "Key rotation" tab
• Click "Edit" on automatic key rotation
• Enable "Automatically rotate this KMS key every year"
• Click "Save changes"

3.2 Set Up Rotation Monitoring

3.3 Document Rotation Schedule

• Create rotation tracking documentation
• Set up SNS notifications for rotation events
• Test rotation process in development environment
• Update incident response procedures

For CMMC Level 3 certification, you must use FIPS 140-2 Level 3 validated hardware security modules. AWS CloudHSM provides this capability with dedicated, single-tenant hardware.

Prerequisites for CloudHSM Integration:

• VPC with private subnets in multiple AZs
• CloudHSM service-linked role permissions
• Budget for CloudHSM costs (~$1,200/month minimum)
• Understanding of HSM cluster management

Console Steps:

4.1 Create CloudHSM Cluster

• Navigate to CloudHSM console
• Click "Create cluster"
• Configure cluster settings:
• VPC: Select your secure VPC
• Availability Zones: Select 2+ AZs
• Subnets: Private subnets only
• Click "Create cluster"

4.2 Create Custom Key Store

• Return to KMS console
• Go to "Custom key stores" in navigation
• Click "Create custom key store"
• Select "CloudHSM key store"
• Configure key store:
• Key store name: CMMC-Level3-HSM-Store
• CloudHSM cluster: Select your cluster
• Trust anchor certificate: Upload HSM certificate

4.3 Create HSM-Backed KMS Key

4.4 Configure HSM High Availability

• Deploy HSMs in multiple Availability Zones
• Set up automated backup schedule
• Configure monitoring and alerting
• Test failover procedures

Real-Time KMS Monitoring

Set up comprehensive monitoring to detect unauthorized key usage and ensure continuous compliance:

Critical Security Alerts

Cross-Account Key Sharing

For multi-account architectures, implement secure key sharing:

Key Performance Optimization

Optimize KMS performance for high-volume applications:

• Use data key caching to reduce API calls
• Implement regional key distribution
• Monitor and optimize encryption context usage
• Set up proper retry and backoff strategies