Welcome back to Backspace Academy. In this hands-on lab we're going to be 2
running through how to create an encryption key using the KMS service and 3
then use that key to encrypt data. So make sure that you've downloaded the lab 4
notes that come to the course. Now the KMS service it's located in the IAM 5
management console so if you look for KMS here you won't find it you need to 6
go to IAM and from there you can scroll down and select encryption keys 7
so you can see here I've got some encryption keys but they're all been created by 8
different AWS services like cloud 9, s3 and all this sort of things so you can 9
see those ones with the Amazon logo next to them they're not ones that I have 10
actually created myself. So what we need to do is create one ourselves that we 11
can use to encrypt data with. So we create a key. Let's give that key a name 12
and we won't bother about a description with it 13
and we click on next step and we won't worry about putting a tag in we don't 14
need that for now, okay so we need to select some administrators, so I'm just 15
going to select myself as an administrator and we also need to select 16
some people that can use this key to encrypt data, so I'm just going to select 17
myself again and next step, so there's our key policy and we click on finish 18
and that's how easy it is to create a key to use on AWS, ok so now that I've 19
created that key I can use that key to encrypt data in Amazon s3, so what I'm 20
going to do is jump into the s3 management console and I'm going to 21
create a bucket, so I'm just going to give this bucket a name and I click on 22
next, ok so now we've got some options here 23
available so if we scroll down we can see automatically encrypt objects when 24
stored in Amazon s3 so that's what we want to do something's going to click on 25
that and what we want to do is that we're not going to use the AWS s3 26
managed key we're going to use the KMS key that we created so we click on KMS 27
and we select our key that we created and there it is test-key and we'll 28
save and there we can see so we've now got that setup and we click on next and 29
I'm just going to leave this as as private I won't change the permissions 30
of it and there we go so we can see here now when we look at the the properties 31
of it we can see here we've got default encryption AWS KMS, so we'll create that bucket 32
so just jump into that bucket now and we're just going to upload some 33
files so I'm just going to grab a little file and upload it, ok so just going to 34
upload one of our review PDFs and we've got some options here for permissions 35
I'll just leave that all as private, ok so now we can select whether we want 36
this to be encrypted or not and so we can see here we can again we can select 37
the AWS KMS I'm going to leave it as none because I want to see what happens 38
if I upload this until AWS not to encrypt it so let's go we'll click on 39
next and we can see here we've got encryption no so let's see what happens 40
so I upload this ok so that's been uploaded, so if I click on that and I 41
have a look at it and we look at the properties we can see that in fact it 42
has been encrypted, so even though we told the s3 service to upload this 43
without encryption it has automatically encrypted that for us 44
because we have defined at the bucket level that anything that goes into this 45
bucket must be encrypted and if you make a mistake and don't and don't select 46
encryption it doesn't matter it will be automatically encrypted when it goes 47
into this bucket so what I'm going to do now is just download that and if I click 48
on that what will happen is that it will be downloaded unencrypted it or 49
decrypted so what that means is that the s3 service has managed everything for us 50
when we don't really have to worry about that at all and the KMS service has 51
supplied the key and it's all quite transparent for us so that's just how 52
easy it is so what we do now is we've finished up with this Labs so what I'll 53
do is I'll just clean it all up so just go back to the main index the demos on 54
s3 and I'll just click on that and delete bucket 55
okay so the buckets been deleted so what we need to do now is just get rid of 56
that key so we can't just delete the key we can delete the key but we can't do it 57
in one hit so what we need to do is go to key actions and schedule key deletion 58
we can't just do it instantaneously and we just have to put a waiting period in 59
there so just put in seven days and schedule that deletion and in seven days 60
that will like that deletion will occur so that brings us to the end of the lab 61
and I hope you enjoyed it and I look forward to seeing you in the next one