Скачать или смотреть AWS Key Management Service Best Practices AWS Key Management Service Best Practices AGPIAL Audiobook

AWS Key Management Service Best Practices AWS Key Management Service Best Practices AGPIAL AudiobookAbstract
AWS Key Management Service (AWS KMS) is a managed service that allows you to concentrate on the cryptographic needs of your applications while Amazon Web Services (AWS) manages availability, physical security, logical access control, and maintenance of the underlying infrastructure.
Further, AWS KMS allows you to audit usage of your keys by providing logs of all API calls made on them to help you meet compliance and regulatory requirements.
Customers want to know how to effectively implement AWS KMS in their environment.
This whitepaper discusses how to use AWS KMS for each capability described in the AWS Cloud Adoption Framework (CAF) Security Perspective whitepaper, including the differences between the different types of customer master keys, using AWS KMS key policies to ensure least privilege, auditing the use of the keys, and listing some use cases that work to protect sensitive information within AWS.

00:00:00 Abstract
00:01:11 Introduction
00:03:15 Identity and Access Management
00:03:29 AWS KMS and IAM Policies
00:05:02 Key Policies
00:07:42 Least Privilege / Separation of Duties
00:09:36 Cross Account Sharing of Keys
00:10:24 CMK Grants
00:11:23 Encryption Context
00:14:08 Multi-Factor Authentication
00:14:53 Detective Controls
00:15:04 CMK Auditing
00:16:14 CMK Use Validation
00:16:53 Key Tags
00:17:37 Infrastructure Security
00:17:51 Customer Master Keys
00:18:09 AWS-managed and Customer-managed CMKs
00:20:25 Key Creation and Management
00:23:16 Key Aliases
00:24:27 Using AWS KMS at Scale
00:26:05 Data Protection
00:26:17 Common AWS KMS Use Cases
00:26:21 Encrypting PCI Data Using AWS KMS
00:27:14 Secret Management Using AWS KMS and Amazon S3
00:28:20 Encrypting Lambda Environment Variables
00:29:03 Encrypting Data within Systems Manager Parameter Store
00:30:32 Enforcing Data at Rest Encryption within AWS Services
00:31:13 Data at Rest Encryption with Amazon S3
00:31:43 Data at Rest Encryption with Amazon EBS
00:33:50 Data at Rest Encryption with Amazon RDS
00:34:41 Incident Response
00:34:49 Security Automation of AWS KMS
00:35:13 Deleting and Disabling CMKs
00:38:31 Conclusion
00:39:04 Contributors