Encryption key service (KMS): what it is and how it is attacked
The service that holds the keys used to scramble stored data, and decides who may use them.
Also known as
- KMS
- key management service
- key vault
- HSM
- customer-managed key
Typing any of them into the editor finds this object.
Why it matters on a security diagram
Scrambling data at rest is only as good as the list of who may use the key, and that is a second set of permissions most reviews never open. It cuts both ways: losing access to a key makes the data unreadable to you as surely as to anybody else.
How it gets attacked, and what reduces it
How it gets attacked
- Use of a key permitted to a far wider set of accounts than the data itself is
- One key shared across environments, so a test system can read live data
- Records of key use not collected, leaving no way to show what was unscrambled
What reduces it
- Read the key policy as carefully as the data permissions, because it is the real control
- Separate keys per environment, so test cannot read live
- Log key use, or you cannot establish what was decrypted
Where it sits
- Group
- Security and edge · The things that sit in front of something else and check what is trying to reach it.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- key-service
Reviewed . CC BY 4.0.
Others in security and edge
- FirewallNGFW · packet filterDecides which connections are allowed between two networks.
- Web app shieldWAF · web application firewallChecks visits to your website and blocks the ones that look like an attack.
- Outbound web filterforward proxy · secure web gateway · SWG · web filter · web proxyChecks and records everything staff and servers send out to the internet.
- Traffic splitterload balancer · LB · ADCSpreads incoming requests across several servers.
- Global content cacheCDN · content delivery network · edge cacheCopies your content to servers worldwide so pages load faster.
- API front doorAPI gatewayOne controlled entrance for the automatic requests other software makes of yours, without a person involved.
- Endpoint protectionEDR · antivirus · AV · XDRSoftware on each computer watching for hostile behaviour.
- Log collectorSIEM · log server · syslogCollects the records of what happened, from every computer and system, into one place.
- Secrets storevault · secrets manager · credential store · password safeThe safe where passwords, keys and certificates are kept.
- Cloud activity recordCloudTrail · activity log · control plane log · audit trailThe provider's own record of every change made to the cloud, and of who made it.
The security and edge group lists all 11 of them side by side.
Encryption key service on your own diagram
Open the editor, press N, and type KMS. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker