AWS Certificate and Key Management

Amazon Web Services (AWS) is a Seattle-headquartered cloud provider originally created to standardize the infrastructure behind Amazon’s retail operations, then launched as a subscription-based platform in 2006. It has become the largest cloud provider by infrastructure footprint and revenue, operating 60 availability zones across 20 regions and serving customers worldwide. AWS positions itself as a platform for “builders,” offering hundreds of services from core infrastructure to advanced capabilities like machine learning and satellite management.

As cloud adoption grows, so does the volume of sensitive data stored and processed in the cloud, making confidentiality, integrity, and availability a central operational, security, and compliance challenge. Under the shared responsibility model, customers remain responsible for protecting their data regardless of the cloud service model. Encryption remains the dominant method for protecting data at rest and in transit, but organizations then face the operational burden of managing numerous encryption keys and certificates across disparate systems.

AWS addresses this through managed services: AWS Key Management Service (KMS), AWS Certificate Manager (ACM), and AWS CloudHSM. KMS centralizes key creation, policy control, rotation, lifecycle actions, and auditing via CloudTrail, and is backed by FIPS 140-2 certified HSM infrastructure abstracted from customers. Its core object is the Customer Master Key (CMK), commonly used to generate data encryption keys (DEKs) that encrypt actual data. AWS distinguishes AWS-owned, AWS-managed, and customer-managed CMKs, with only customer-managed keys providing full customer control and incurring KMS monthly fees. For stricter requirements, KMS can use a single-tenant custom key store backed by CloudHSMv2, though it cannot connect to on-premises HSMs for HYOK scenarios. ACM automates TLS certificate provisioning, validation (including Route 53 automation), deployment, and renewal for Amazon-issued certificates, integrates broadly across AWS services at no added charge, and can extend to private certificates via ACM Private CA.

• AWS launched its cloud platform in 2006 as a subscription-based offering for on-demand infrastructure access.
• AWS operates 60 availability zones across 20 regions.
• AWS Key Management Service (KMS) integrates natively with over 50 AWS services.
• KMS is backed by Hardware Security Modules certified to the FIPS 140-2 standard.
• The primary KMS concept is the Customer Master Key (CMK), which includes metadata and an HSM Backing Key (HBK).
• Domain Keys remain inside KMS throughout their lifecycle and never leave the service.
• AWS-owned CMKs are controlled by AWS administrators and are not accessible to customers.
• AWS-managed CMKs can be audited by customers but cannot have customer-controlled usage or access permissions.
• Only customer-managed CMKs count toward the monthly KMS fee.
• KMS can integrate with a custom key store backed by a single-tenant AWS CloudHSMv2 cluster, but does not support connecting to on-premises HSMs for HYOK.

• “Ensuring constant integrity and confidentiality of such information without negatively affecting its availability for business purposes is perhaps the biggest operational, security and compliance challenge for any company.”
• “According to the shared responsibility model, data protection in the cloud remains the sole responsibility of customers regardless of the service model.”
• “Despite occasional attempts of certain government agencies to limit the use of data encryption, it remains the most mature, well-established and popular method of protecting data from unauthorized access both at rest and in transit.”
• “However, with so many disparate encryption tools in place, the next challenge for enterprises is keeping track of the numerous encryption keys.”
• “However, believing that this always ensures security and compliance of customer data held or processed by a particular service would be a potentially dangerous and costly mistake.”
• “Customers can choose between relying on keys automatically managed by AWS or having full control over their own master keys.”
• “For these use cases, KMS can be integrated into a customer key store implemented as a cluster of AWS CloudHSMv2 cloud-based hardware security modules provisioned for a single tenant, which provides the highest level of compliance with security, privacy, and anti-tamper regulations.”
• “Unfortunately, KMS does not support any other custom HSMs, for example, connecting to an existing on-premises deployment to implement the Hold Your Own Key (HYOK) scenario.”
• “Perhaps the biggest selling point of ACM is its integration with a number of other AWS services that rely on TLS certificates for proper operation.”
• “They may not offer the same level of functionality as traditional on-premises ECM and EKM solutions, but for the majority of cloud-focused organizations, there isn’t really any valid reason not to start using AWS key and certificate management services right now.”