Understanding the shared responsibility model and AWS KMS XKS
summary
AWS KMS can extend to an external key store (XKS) so keys live wholly outside AWS while KMS stays the API frontend; KMS HSMs are FIPS 140-2 Level 3 certified and XKS interaction uses only four APIs (Encrypt, Decrypt, Verify metadata, KeepAlive) with no key material cached or transferred. Responsibility shifts: customers run HA XKS proxies, maintain TLS certs (dashboard shows expiry, latency, request counts), and bear availability (no KMS SLA on XKS); target topology is within ~1,000 km/350 miles for ~35 ms latency.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:47Shared responsibility model
- 5:08Introduction to XKS
- 9:41Architecture and operations
- 12:49Monitoring and management
- 13:42Use cases and constraints
- 14:59Security model comparison
- 17:20Conclusion
related talks
51mUsing Key Management Service for data protection
45mLet's Encrypt Everything, Really Everything
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
27mEncrypting 6 Petabytes of Customer Data with AWS KMS
28mYour Secrets in Cloud-Based Key Management Services
20mApplication Secret Management with AWS KMS
38mHow to Distribute Keys Securely for 20% of the Web
26mProtecting your data in Amazon S3