I am exploring the AWS KMS as a vault for storing the encryption keys. Now I am trying to encrypt the database fields like email.

So, issue whenever there is a read/write for email, I don't want to hit the AWS APIs(using SDK) to encrypt/decrypt.

What I am thinking is that, is there a way I can get the plaintext data key using SDK and store it in memory for some time and uses it for encryption/decryption.

I am playing with SDK but I am not seeing anything to get the data keys.

I need this for two reasons a) Throughput/performance b) Costing reduction

I have my data in in-house physical machines not in AWS


The entire point of KMS is to securely store encryption keys. As a result, you aren't finding any options to extract the key because such an option does not exist by design. This question is like saying, "I need a bank with a secure vault that I can store my driver's license in so it never gets stolen, but I also want to keep it in my wallet for when I go to the store". These needs are, quite simply, completely contradictory.

If for some reason you did want to do that, then you can use a KMS with a customer managed key. This will allow you to generate your own key, hand it to AWS, and they will place it in the KMS for you. At that point in time you can have a copy of the key yourself and AWS will also have a copy of they key that you can use via KMS.

A more common use case would be to use KMS to encrypt the actual encryption key for your data. This way the key can be stored in encrypted form. When your application starts it takes the encrypted key, calls KMS to decrypt it, stores the decrypted key in memory, and then can operate normally.

  • Right, but then for every encryption/decryption, I need to call AWS. This will impact performance / Costing. Plus is it guaranteed if I encrypt same email , cipher will always be same. I need to compare the encrypted data, – Ankit Bansal Oct 7 '20 at 9:58
  • @AnkitBansal This is covered by my paragraphs 2 and 3. – Conor Mancone Oct 7 '20 at 10:02
  • One more thing, might be a stupid question. When you say "customer managed key", you mean , "customer managed master key" right? – Ankit Bansal Oct 7 '20 at 10:15
  • @AnkitBansal Specifically, the customer managed CMKs (rather than the AWS managed CMK). It's very confusing because CMK stands for customer master key, so we're talking about "customer managed customer master keys" vs "aws managed customer master keys". It makes sense when you dive into it, but it's very confusing on the surface. To be very specific, docs are here: docs.aws.amazon.com/kms/latest/developerguide/… – Conor Mancone Oct 7 '20 at 10:17
  • @AnkitBansal I forgot how terrible their documentation is here. This may help more: docs.aws.amazon.com/kms/latest/developerguide/… – Conor Mancone Oct 7 '20 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.