> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo S3 and EBS Using KMS and SSE

> Guide showing how to create a customer-managed AWS KMS key and use it to enable S3 SSE-KMS and encrypt EBS volumes, including key policy and console steps.

This walkthrough demonstrates how to use an AWS customer-managed KMS key to enable server-side encryption (SSE) for Amazon S3 and to encrypt Amazon EBS volumes. You will:

* Create a symmetric KMS key (customer-managed).
* Inspect the key policy that governs key administration and usage.
* Configure an S3 bucket to use SSE-KMS with that key.
* Create and encrypt an EBS volume with the same KMS key.

Prerequisites: an AWS account with permissions to manage KMS keys, create S3 buckets, and create EBS volumes (IAM permissions such as `kms:*` for key admin tasks and `ec2:*`, `s3:*` for resource creation).

## 1) Create a customer-managed KMS key

Open the AWS Key Management Service (KMS) console, select Customer managed keys, and click Create key.

Recommended choices during creation:

* Key type: symmetric (used for both encryption and decryption).
* Key usage: Encrypt and decrypt.
* Alias: provide a friendly alias (example: `demo-encryption-key`).
* Description: short description of the key purpose.
* Administrators: assign one or more IAM users or roles who can manage the key.
* Key usage permissions: grant IAM principals permission to use the key for encrypt/decrypt operations.

When creation finishes, KMS provides a default key policy that defines who can manage and use the key. For most demos and common setups the default key policy plus IAM policies is sufficient; you only need to author a custom key policy for advanced, restrictive scenarios.

![A screenshot of the AWS KMS console showing a customer-managed key details page. The "Key policy" tab is selected, showing the Key policy and Key administrators sections with action buttons like "Switch to policy view", "Add", and "Remove."](https://mintcdn.com/kodekloud-c4ac6d9a/FCC3Du5gLxWM9z2p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-S3-and-EBS-Using-KMS-and-SSE/aws-kms-key-policy-tab.jpg?fit=max\&auto=format\&n=FCC3Du5gLxWM9z2p\&q=85\&s=e767a95dc2d0ceee4dc25e9f8377137f)

Example of a default KMS key policy (account and user ARNs are from the demo environment):

```json theme={null}
{
  "Id": "key-consolepolicy-3",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::635573991785:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow access for Key Administrators",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::635573991785:user/arno"
      },
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
```

KMS key policies are the authoritative control for who can administer and use a customer-managed key. Often the default key policy together with IAM policies is sufficient; for stricter separation of duties create a custom key policy. See the AWS KMS documentation for examples and policy structure.

Be careful with key deletion and policies. If you delete or disable a KMS key (or remove all principals from its policy), any data encrypted with that key (S3 objects, EBS snapshots, etc.) can become permanently inaccessible.

## 2) Configure an S3 bucket with SSE-KMS

To enable server-side encryption using your KMS key:

1. Open the Amazon S3 console and create a new bucket (choose the target region, e.g., `us-east-2`).
2. Specify a globally unique bucket name (example: `eden-geeking-encrypt-test-bucket`).
3. Under Default encryption, choose Server-side encryption with AWS KMS (SSE-KMS).
4. Select the customer-managed KMS key you created (choose by alias or paste the key ARN).

When S3 is configured to use SSE-KMS, S3 requests data keys from KMS to encrypt objects at rest; KMS performs the cryptographic operations and centralizes key management and auditability.

![A screenshot of the AWS S3 "Create bucket" console showing an ARN-selected AWS KMS key and the S3 Bucket Key option set to "Enable." The page also shows the "Advanced settings" section collapsed.](https://mintcdn.com/kodekloud-c4ac6d9a/FCC3Du5gLxWM9z2p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-S3-and-EBS-Using-KMS-and-SSE/s3-create-bucket-kms-key-enabled.jpg?fit=max\&auto=format\&n=FCC3Du5gLxWM9z2p\&q=85\&s=888026d7f740984d518b4999aae559c5)

After creating the bucket, verify Default encryption in the bucket Properties. The console will list SSE-KMS and the key ARN assigned to the bucket, for example:

```text theme={null}
arn:aws:kms:us-east-2:635573991785:key/874b91b4-a125-4b15-899f-f040c176257e
```

This confirms objects uploaded to the bucket will be encrypted using your KMS key.

Recommended reading:

* [AWS KMS developer guide](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)
* [Amazon S3 SSE-KMS docs](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html)

## 3) Encrypt an EBS volume using KMS

You can also encrypt EBS volumes with the same KMS key. This provides at-rest encryption for volume data and ensures snapshots created from the encrypted volume are encrypted as well.

Steps in the EC2 console:

1. Go to Elastic Block Store → Volumes and click Create volume.
2. Choose volume characteristics:
   * Volume type (e.g., General Purpose SSD (gp3) or Provisioned IOPS).
   * Size (GiB) and IOPS/Throughput as required.
   * Availability Zone (must match the instance if you intend to attach immediately).
3. Enable encryption: check Encrypt this volume.
4. Select the customer-managed KMS key (alias/ID/ARN will appear in the selection).

![Screenshot of the AWS EC2 "Create volume" page showing volume settings — Size 100 GiB, IOPS 3000, Throughput 125 MiB/s, and Availability Zone use2-az1 (us-east-2a). The top bar shows the CloudWithDjango-Org account in the us-east-2 region.](https://mintcdn.com/kodekloud-c4ac6d9a/FCC3Du5gLxWM9z2p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-S3-and-EBS-Using-KMS-and-SSE/aws-ec2-volume-100gib-3000iops-use2a.jpg?fit=max\&auto=format\&n=FCC3Du5gLxWM9z2p\&q=85\&s=15811522b82afe248f58958184cd7d46)

Additional volume creation options (e.g., start from a Snapshot ID, tags) are available on the same create volume form. Ensure the Encrypt this volume option is checked and the correct KMS key selected.

![Screenshot of the AWS EC2 "Create volume" page showing options for Snapshot ID, an "Encrypt this volume" checkbox for EBS encryption, and a section for optional tags.](https://mintcdn.com/kodekloud-c4ac6d9a/FCC3Du5gLxWM9z2p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-S3-and-EBS-Using-KMS-and-SSE/ec2-create-volume-encrypt-snapshot-tags.jpg?fit=max\&auto=format\&n=FCC3Du5gLxWM9z2p\&q=85\&s=85aa1ba2690bd5e91145d8c3fc3a58aa)

After creation, refresh the Volumes list. Encrypted volumes show their Encryption status and the KMS key alias/ID in the console.

![A screenshot of the AWS EC2 Volumes console listing two volumes with columns for encryption status, KMS key ID/alias, initialization state and other properties. The top bar shows region/account controls and action buttons like "Create volume" and "Recycle Bin."](https://mintcdn.com/kodekloud-c4ac6d9a/FCC3Du5gLxWM9z2p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-S3-and-EBS-Using-KMS-and-SSE/aws-ec2-volumes-console-encryption-kms.jpg?fit=max\&auto=format\&n=FCC3Du5gLxWM9z2p\&q=85\&s=498f85b430b971ca223e4736a5577061)

Notes:

* Encrypted EBS volumes: data stored at rest, disk I/O, and snapshots are encrypted.
* You can specify the KMS key when creating a snapshot or let AWS use the same key automatically for snapshot encryption.

## Quick reference: S3 SSE-KMS vs EBS encryption

| Resource | Encryption mechanism | Key management | Notes |
| - | - | - | - |
| S3 (SSE-KMS) | Server-side encryption using KMS-managed data keys | Customer-managed KMS key or AWS-managed key | Use for object-level encryption and fine-grained key access controls |
| EBS volumes | Volume-level encryption using customer KMS key | Customer-managed KMS key or AWS-managed key | Snapshots of encrypted volumes remain encrypted |

## Summary / Exam tips

* KMS (AWS Key Management Service) is the centralized service for managing cryptographic keys across AWS services.
* Server-side encryption for S3 (SSE-KMS) uses KMS to protect data keys and provide auditability via AWS CloudTrail.
* EBS encryption can be enabled per-volume using a KMS key; snapshots of encrypted volumes remain encrypted.
* KMS key policies (together with IAM policies) determine who can administer and use a key — understanding key policies is important for exams and real-world access control.
* Always consider key lifecycle and recovery: disabling or deleting a KMS key can make encrypted data inaccessible.

Further reading:

* [AWS KMS developer guide](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)
* [Amazon S3 encryption overview](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html)
* [Amazon EBS encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/d51f4260-d612-4dcb-9a91-4eeb6540c6c7/lesson/47f601ad-f078-4921-80cf-44ece50edaed)**

> **[Practice Lab](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/d51f4260-d612-4dcb-9a91-4eeb6540c6c7/lesson/9946f5a3-5396-4457-bc20-6f1baad12354)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.