I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon access key and secret key.

So I am no longer storing a plaintext symmetric key on my server, but I am now storing an encrypted key and my AWS access keys... is this not essentially the same as storing the plaintext there? Someone with access to my server would only have to take the encrypted key and my Amazon access keys and ask Amazon to decrypt it?

migrated from crypto.stackexchange.com Dec 24 '16 at 18:08

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • 3
    I think the point of AWS KMS is a) to allow you to encrypt your data on AWS more easily (they integrate nicely with S3 and EBS) and b) centralize key management. This way you hand your application just one access key (or some other credential?) and it can (or cannot) arbitrarily request data-key decryption. This will then allow you to a) audit the key usage centrally b) allow you to scale easier (as syncing is now amazon's problem) and c) manage the keys more centrally (for example rotate them or destroy them). From a pure security standpoint there is little difference indeed. – SEJPM Dec 23 '16 at 22:39
up vote 1 down vote accepted

If your server resides in EC2, you can use IAM to create a role for that server and allow it access to KMS without needing to have the AWS access keys on the server.


Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.