Data is encrypted with an AWS KMS key.
The team must control which principals can use the key.
Which task belongs to the customer?
AWS provides the KMS service infrastructure, while the customer chooses key usage permissions through key policies and IAM permissions.
Detailed explanation
Customer access should be limited to the required principals and operations rather than shared broadly.
Customer access should be limited to the required principals and operations rather than shared broadly.
The customer controls key policies, IAM permissions, and the scope of key use for its data.
The customer controls key policies, IAM permissions, and the scope of key use for its data.
Physical equipment lifecycle is an AWS responsibility.
Physical equipment lifecycle is an AWS responsibility.
AWS manages the hardware and service infrastructure that implements KMS.
AWS manages the hardware and service infrastructure that implements KMS.
Check official documentation
Compare the following points with the official documentation.
AWS KMS Developer GuideのKey policiesとIAM policiesの関係を確認する。
What to confirm
KMSキーの利用権限とポリシーは利用者側の管理対象である。
Key points
- AWS KMS
- Key policy
- Least privilege
Notes
- Environment: AWS公式ドキュメントのKMS権限確認
- Confirm the service-specific responsibility boundary in the current AWS documentation.
Foundation review
Key-control boundary
AWS provides the cryptographic service while the customer controls who can use a key.
Permission combination
KMS key policy and IAM permissions together determine effective access.