Skip to main content
This walkthrough demonstrates how to use an AWS customer-managed KMS key to enable server-side encryption (SSE) for Amazon S3 and to encrypt Amazon EBS volumes. You will:
  • Create a symmetric KMS key (customer-managed).
  • Inspect the key policy that governs key administration and usage.
  • Configure an S3 bucket to use SSE-KMS with that key.
  • Create and encrypt an EBS volume with the same KMS key.
Prerequisites: an AWS account with permissions to manage KMS keys, create S3 buckets, and create EBS volumes (IAM permissions such as kms:* for key admin tasks and ec2:*, s3:* for resource creation).

​
1) Create a customer-managed KMS key

Open the AWS Key Management Service (KMS) console, select Customer managed keys, and click Create key. Recommended choices during creation:
  • Key type: symmetric (used for both encryption and decryption).
  • Key usage: Encrypt and decrypt.
  • Alias: provide a friendly alias (example: demo-encryption-key).
  • Description: short description of the key purpose.
  • Administrators: assign one or more IAM users or roles who can manage the key.
  • Key usage permissions: grant IAM principals permission to use the key for encrypt/decrypt operations.
When creation finishes, KMS provides a default key policy that defines who can manage and use the key. For most demos and common setups the default key policy plus IAM policies is sufficient; you only need to author a custom key policy for advanced, restrictive scenarios.
A screenshot of the AWS KMS console showing a customer-managed key details page. The "Key policy" tab is selected, showing the Key policy and Key administrators sections with action buttons like "Switch to policy view", "Add", and "Remove."
Example of a default KMS key policy (account and user ARNs are from the demo environment):
KMS key policies are the authoritative control for who can administer and use a customer-managed key. Often the default key policy together with IAM policies is sufficient; for stricter separation of duties create a custom key policy. See the AWS KMS documentation for examples and policy structure.
Be careful with key deletion and policies. If you delete or disable a KMS key (or remove all principals from its policy), any data encrypted with that key (S3 objects, EBS snapshots, etc.) can become permanently inaccessible.

​
2) Configure an S3 bucket with SSE-KMS

To enable server-side encryption using your KMS key:
  1. Open the Amazon S3 console and create a new bucket (choose the target region, e.g., us-east-2).
  2. Specify a globally unique bucket name (example: eden-geeking-encrypt-test-bucket).
  3. Under Default encryption, choose Server-side encryption with AWS KMS (SSE-KMS).
  4. Select the customer-managed KMS key you created (choose by alias or paste the key ARN).
When S3 is configured to use SSE-KMS, S3 requests data keys from KMS to encrypt objects at rest; KMS performs the cryptographic operations and centralizes key management and auditability.
A screenshot of the AWS S3 "Create bucket" console showing an ARN-selected AWS KMS key and the S3 Bucket Key option set to "Enable." The page also shows the "Advanced settings" section collapsed.
After creating the bucket, verify Default encryption in the bucket Properties. The console will list SSE-KMS and the key ARN assigned to the bucket, for example:
This confirms objects uploaded to the bucket will be encrypted using your KMS key. Recommended reading:

​
3) Encrypt an EBS volume using KMS

You can also encrypt EBS volumes with the same KMS key. This provides at-rest encryption for volume data and ensures snapshots created from the encrypted volume are encrypted as well. Steps in the EC2 console:
  1. Go to Elastic Block Store → Volumes and click Create volume.
  2. Choose volume characteristics:
    • Volume type (e.g., General Purpose SSD (gp3) or Provisioned IOPS).
    • Size (GiB) and IOPS/Throughput as required.
    • Availability Zone (must match the instance if you intend to attach immediately).
  3. Enable encryption: check Encrypt this volume.
  4. Select the customer-managed KMS key (alias/ID/ARN will appear in the selection).
Screenshot of the AWS EC2 "Create volume" page showing volume settings — Size 100 GiB, IOPS 3000, Throughput 125 MiB/s, and Availability Zone use2-az1 (us-east-2a). The top bar shows the CloudWithDjango-Org account in the us-east-2 region.
Additional volume creation options (e.g., start from a Snapshot ID, tags) are available on the same create volume form. Ensure the Encrypt this volume option is checked and the correct KMS key selected.
Screenshot of the AWS EC2 "Create volume" page showing options for Snapshot ID, an "Encrypt this volume" checkbox for EBS encryption, and a section for optional tags.
After creation, refresh the Volumes list. Encrypted volumes show their Encryption status and the KMS key alias/ID in the console.
A screenshot of the AWS EC2 Volumes console listing two volumes with columns for encryption status, KMS key ID/alias, initialization state and other properties. The top bar shows region/account controls and action buttons like "Create volume" and "Recycle Bin."
Notes:
  • Encrypted EBS volumes: data stored at rest, disk I/O, and snapshots are encrypted.
  • You can specify the KMS key when creating a snapshot or let AWS use the same key automatically for snapshot encryption.

​
Quick reference: S3 SSE-KMS vs EBS encryption

​
Summary / Exam tips

  • KMS (AWS Key Management Service) is the centralized service for managing cryptographic keys across AWS services.
  • Server-side encryption for S3 (SSE-KMS) uses KMS to protect data keys and provide auditability via AWS CloudTrail.
  • EBS encryption can be enabled per-volume using a KMS key; snapshots of encrypted volumes remain encrypted.
  • KMS key policies (together with IAM policies) determine who can administer and use a key — understanding key policies is important for exams and real-world access control.
  • Always consider key lifecycle and recovery: disabling or deleting a KMS key can make encrypted data inaccessible.
Further reading:

Watch Video

Practice Lab