CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2aws-lambdapublic-key-encryptionamazon-kms
Joshy
Joshy

Reputation: 657

How to manage Asymmetric (Public/Private) Keys in AWS

I need to develop a solution to store both symmetric and asymmetric keys securely in AWS. These keys will be used by applications that are running on EC2s and Lambdas. The applications will need to be set up with policies that will allow the application or lambda to pull the keys out of the key store. The key store should also manage the key expiry, notifying various people when keys are going to expire. The initial key exchange is between my company and its partners meaning that we may have either a public or private key for a key pair depending upon the data transfer direction.

We have looked at KMS but from what I have seen KMS does not support asymmetric keys. I have also seen online that some people are using either S3 (protected by KMS) or parameter store to store the keys but this does not address the issue of key management.

Do you guys have any thoughts on this? or even SaaS/PaaS suggestions?

Upvotes: 9

Views: 2424

Answers (1)

Viccari
Viccari

Reputation: 9318

My recommendation would be to use AWS Secrets Manager for this. Secrets Manager allows you to store any type of credential/key, you can set up fine-grained cross account permissions to secrets, encryption at rest is used (via KMS), and secrets can be automatically rotated (by providing an expiration time and an AWS Lambda function owned by you to perform the rotation).

More details on the official docs:

Upvotes: 3

Related Questions