What is Cloud KMS? What's it's purpose/benefit of KMS? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)

Question

What is Cloud KMS? What's it's purpose/benefit of KMS? Is there a concrete example of a problem I solve using it? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)
Whenever I've tried to read the official docs
https://aws.amazon.com/kms/
https://cloud.google.com/kms/
https://docs.microsoft.com/en-us/azure/key-vault/key-vault-whatis

I'd never get any useful information out of the official docs, I'd get:

• Generic Explanations:
  KMS: Key Management System, we help you centrally manage your encryption keys.
  (I got that from the name... but what does that actually mean? I'm not even sure if I have any keys I need to manage. I can't think of a scenario where I'd be using so many encryption keys that I'd need help managing them. Is this some product that's only meant for huge organizations?)
• Generic Benefits:
  (buzz words you can say about any product aka meaningless for an explanation.)
  "fully managed", "central management", "low cost", "auditable", "encryption", "secure", "helps meet compliance regulations", "scalable", "automated", "integrated", "REST API", "highly available", "HSM backed", "protect secrets")
  (Ok this might be cool, but wdf does it actually do? How does KMS help me meet compliance regulations, give a concrete example? You help protect secrets? How? I'm already keeping my secrets secret, the name told me to do that... So what are you actually offering? This sounds like it'll add complexity without adding any benefits)
• No concrete explanation or concrete examples of KMS benefits/problems that can be solved using KMS:
  Whenever I've tried to look deeper I'd either find nothing, or explanations that would go over my head. I need to know a concrete, relatable problem, that KMS helps me solve.

Answer 1

KMS allows you to encrypt/decrypt data without ever seeing your master keys. It makes managing encryption keys simpler because there's nothing you can do that can allow you to leak the master key.

They can also manage the choices of encryption algorithm, and the mechanism for upgrading algorithm choice. So these decisions are made for you so you can't accidentally configure weak encryption parameters.

Also note though, that the cynical part of you should also notice that the pronunciation of "Cloud KMS" is very similar to "vendor lock in". It makes it really hard to switch cloud provider as you can't easily move your data without also decrypting everything first. Some KMS solutions allow you to import your own key, which can reduce your surface, but brings you back into having to protect your master key and since most Cloud HSM don't specify the encryption parameters and algorithms in a vendor neutral term, you still can't easily decrypt your data even if you have a copy of your imported master key.

Probably the biggest advantage of a Cloud KMS though is logging and auditing. Building your own logging and audit infrastructure for key usage is normally non trivial, but it comes out of the box with most Cloud KMS.

Answer 2

What's the purpose/benefit of KMS?

1. KMS prevents the leaking of decryption keys, similar to a HSM, but HSM's are expensive and hard to use. KMS's are cheap and easy to use because they have API endpoints.
2. KMS shifts the problem of controlling access to encrypted data from a decryption key management problem (where granular access and ability to revoke access were impossible) to an identity and access management problem (where ACLs can be used to easily manage access, grant granular access, and revoke access.)
3. Increased auditability and control over access to encrypted data.

Give me a concrete example of a problem KMS solves/benefit to using KMS:
KMS allows you to safely store encrypted secrets in git, in a way where the decryption keys won't leak, you can control access to the encrypted secrets at a granular level and revoke access without needing to make any changes to the encrypted files.

What is Cloud KMS? How does it work?
KMS is an encryption technique that addresses the shortcomings of symmetric, asymmetric, and HSM encryption. It's the foundation of future encryption techniques like crypto anchors.

Abridged Evolution of Cryptography

1. Symmetric Encryption Keys:
   • Long password is used for both encryption and decryption.
2. Asymmetric Encryption Public-Private Key Pairs:
   • Public key encrypts data, private key decrypts data encrypted with the public key.
3. HSMs (Hardware Security Modules):
   • Make it so the private key doesn’t get leaked.
   • HSMs are expensive.
   • HSMs are not user or automation friendly.
4. Cloud KMSs (Key Management Services):
   • KMS is a trusted service that encrypts and decrypts data on behalf of clients, it basically allows a user or machine to encrypt and decrypt data using their identity instead of encryption/decryption keys. (A client authenticates against a KMS, which checks their identity against an ACL, if they have decryption rights, the client can send encrypted data in a request to the KMS, which will then decrypt the data on behalf of the client, and send the decrypted data back to the client over a secure TLS tunnel.)
   • KMSs are cheap.
   • KMSs are exposed via REST API, which makes them user and automation friendly.
   • KMSs are extremely secure, they make it feasible to go a decade without leaking decryption keys.
   • KMS encryption technique’s invention introduced 3 killer pieces of functionality:
     1. When responding to a known breach: Before KMS decryption keys would get leaked: you can’t revoke a decryption key, which means you’d need to rotate several decryption keys, re-encrypt all data with the new keys, and try your best to purge old encrypted data. While doing all of this you’ll need to fight with management to get approval to cause downtime to several production systems, minimize said downtime, and even if you do everything right, you may be unable to completely purge the old encrypted data, like in the case of git history, and backups. After KMS it’s identity credentials that get leaked: Identity credentials can be revoked, when they’re revoked they’re worthless. The nightmare of re-encrypting data and purging old encrypted data goes away. You still need to rotate secrets (identity credentials vs decryption key), but the act of rotation becomes cheap enough that it can be automated and scheduled as a preventative measure.
     2. Management of encrypted data shifts from an impossible task involving distributed decryption keys, to a trivial task of managing a centralized ACL. It now becomes possible to easily revoke, edit, and assign granular access to encrypted data; and as a bonus since Cloud KMS, IAM, and SSO Identity Federations integrate together, you can leverage preexisting user identities.
     3. Crypto Anchoring techniques become possible:
        • Network ACLs can be applied to KMS to make it so data can only be decrypted in your environment.
        • KMS decryption rates can be monitored for a baseline, when an anomalous rate occurs, alerts and rate limiting can be triggered.
   • KMS’s decryption keys can be secured by an HSM.
   • Opportunities for decryption keys to get leaked are near zero because clients don’t interact directly with decryption keys.
   • Cloud Providers can afford to hire the best security professionals and implement expensive operational processes that are required to keep the backend systems as secure as possible, so backend key leakage opportunities are also near zero.

---

How do I use KMS?

• Mozilla SOPS is a tool that wraps/abstracts KMS, it's great for securely storing encrypted secrets in git.
• Helm Secrets Plugin, wraps Mozilla SOPS, so you can safely store encrypted Kubernetes yamls in git, and then when it's time to apply them have the secret values get seamlessly decrypted at the last minute, right before they go into an encrypted TLS tunnel that goes directly to the kube-apiserver, and then Kubernetes can use KMS to re-encrypt Kubernetes Secrets, so they're encrypted in etcd database.