Client Side Encryption

Client Side Encryption

  1. Execute the below command to create the text file
sudo echo "Sample Secret Text to Encrypt" > samplesecret.txt

Server Side Encryption 2. Assign the permission to the Instance to create the key

  1. AWS IAM Console Create policy page
  • Click Service.
  • Type kms into the search bar.
  • Click KMS Server Side Encryption
  1. In the Actions section
  • Assign GenerateDataKey permission
    • Type GenerateDataKey into the search bar
    • Select GenerateDataKey Server Side Encryption
  • Do the same for Encrypt permission, Decrypt permission, TagResource permission, Untagresource permission và GenerateDataKeyWithoutPlainText permission
  1. In the Resources section
  • Click Resources
  • Select Specific
  • in the key section, Select Any in this account
  • Click Next:Tags Server Side Encryption
  1. AWS IAM Console Add tags page
  • Click Next:Review Server Side Encryption
  1. AWS IAM Console Review policy page
  • in the Name section, type KMSWorkshop-AdditionalPermissions
  • Click Create Policy Server Side Encryption
  1. Attach KMSWorkshop-AdditionalPermissions policy to KMSWorkshop-InstanceInitRole role
  1. In the Permissions policies section
  • Click Add permissions.
  • Click Attach policies. Server Side Encryption
  1. In the Other permissions policies section
  • Type KMSWorkshop-AdditionalPermissions into the search bar, press Enter
  • Select KMSWorkshop-AdditionalPermissions.
  • Click Attach policies. Server Side Encryption
  1. Execute the below command to create the Data key
aws kms generate-data-key --key-id alias/ImportedCMK --key-spec AES_256 --encryption-context project=workshop

Server Side Encryption

  • The command will return a JSON output with:
    • the plaintext data key - Plaintext key in b64 encoding
    • the KeyId used to encrypt plaintext data key
    • A CiphertextBlob which is the encrypted data key generated, in base64 enconding.
  1. Execute the below command to decode the Plaintext key and the CiphertextBlob we obtained above, as they are in b64, and store them in datakeyPlainText.txt file and datakeyEncrypted.txt file
echo '<Plantext value of the JSON file in step 11>' | base64 --decode > datakeyPlainText.txt
echo '<CipherTextBlob value of the JSON file in step 11>' | base64 --decode > datakeyEncrypted.txt

Server Side Encryption 13. Execute the below command to encrypt file samplesecret.txt in AES256 bits and saves the encrypted output to file “encryptedSecret.txt”.

openssl enc -e -aes256 -in samplesecret.txt -out encryptedSecret.txt -k fileb://datakeyPlainText.txt

Server Side Encryption 14. Execute the below command to check the encrypted content

openssl enc -e -aes256 -in samplesecret.txt -out encryptedSecret.txt -k fileb://datakeyPlainText.txt

Server Side Encryption 15. Execute the below command to delete the plaintext key.

rm datakeyPlainText.txt

Server Side Encryption

Following security best practice, we must to delete the Data Key in Plain Text after ecrypting the data. Therefore, we need dencrypt the encrypted data key to dencrypt the encrypted text file.

16. Execute the below command to decrypt file datakeyEncrypted.txt.

aws kms  decrypt --encryption-context project=workshop --ciphertext-blob fileb://datakeyEncrypted.txt

Server Side Encryption 17. Execute the below command to decode the data key from base64 and use it to decrypt the encrypted secret file encryptedSecret.txt.

echo '<Plantext value of the JSON file in step 16>' | base64 --decode > datakeyPlainText.txt

Server Side Encryption 18. Execute the below command to decrypt ecrypted file Text

openssl enc -d -aes256 -in encryptedSecret.txt -k fileb://datakeyPlainText.txt

Server Side Encryption 19. Execute the below command to delete the plaintext key.

rm datakeyPlainText.txt

Server Side Encryption