what is benefit of using KMS to "encrypt" between two AWS users, instead of just sending directly through AWS?

Question

I am just learning KMS and how granting encrypt/decrypt permissions on KMS keys works, but I don't understand what is the benefit of using KMS to encrypt data to send to another AWS customer, who then uses KMS to decrypt it -- when you could just use AWS infrastructure to send the data directly.

Conceptually what I understand is the following: Alice creates a KMS secret key, then uses KMS APIs to encrypt some data. Alice sends the encrypted data to Bob who is also an AWS customer, and Alice grants Bob "decrypt" permissions on that KMS key. Bob calls decrypt and passes the data and obtain the cleartext. Correct so far?

What I don't understand is how this could possibly be any more secure than Alice simply uploading the data and granting Bob read permission on it. In both cases, the first step is Alice uploading the data to AWS; in both cases, the last step is Bob downloading the data from AWS; and in both cases, the mechanism is only as good as AWS enforcing the permissions correctly.

And if Alice simply granted read permission on the data to Bob, that would abstract away all the details of creating and rotating encryption keys, handling encrypt/decrypt permissions, etc. and so the user would be less likely to make a mistake.

What am I missing? What is the benefit of using AWS KMS to share data between AWS customers, instead of just granting read access on objects?

Answer 1

In both cases, the first step is Alice uploading the data to AWS; in both cases, the last step is Bob downloading the data from AWS; and in both cases, the mechanism is only as good as AWS enforcing the permissions correctly.

That's true, but you're losing some nuance here.

First, you're doing an "in both cases" comparison, but you haven't said what the other case is. You're comparing a concrete service and permission model (sharing symmetric keys in AWS KMS) against ... what? An S3 bucket? AWS Aurora with user-level read permissions? Github private repo? Maybe the alternative is just as secure and easy to configure (ie difficult to make human error), but it's hard to make an apples-to-apples comparison when you haven't said what you're comparing it to.

Second, regardless of the alternative, one strong win for KMS encryption is that the data is wrapped / encrypted, so you can bring it out of the db, handle it in your application, transport it, cache it, store it in a processing queue, heck you could even send it across the internet over HTTP, and you know that there's no risk of someone gaining access to it unless they also somehow have access to your KMS instance (and to Alice or Bob's accounts on top of that). For many products, that opens up architectures that would not be possible otherwise with an access-controlled-read db model (for example it's trivial to make a cold-storage backup of the db, even one row at a time, with zero risk of leaking the data).