Monitoring AWS KMS

Monitoring AWS KMS

Monitoring is an important part of understanding the availability, state, and usage of your customer master keys (CMKs) in AWS KMS and maintaining the reliability and performance of your AWS solutions. As a baseline, in AWS KMS you may want to monitor:

  • Activity related to cryptographic operations, such as Encrypt or Decrypt.
  • Activity related to management operations on the CMKs: EnableKey, ImportKeyMaterial,etc…
  • Activity on other events and metrics, such as key expiration, key rotation or time remaining until imported key material expiration.

To monitor that activity we will use the AWS service AWS CloudTrail and Amazon CloudWatch, especially its logs, events and alarms.

AWS KMS và AWS CloudTrail

  • AWS KMS is integrated with AWS CloudTrail. AWS CloudTrail is a service that will provide us with a record of actions performed by a user, role, or an AWS service in AWS KMS.
  • CloudTrail captures all API calls for AWS KMS as events, including calls from the AWS KMS console and from code calls to the AWS KMS APIs.

To see how CloudTrail logs this information. We take the below steps

  1. Execute the below command to create the new data key
aws kms generate-data-key --key-id alias/ImportedCMK --key-spec AES_256 --encryption-context project=workshop

Monitoring KMS 2. Check the actions was saved in AWS CloudTrail

  • Go to AWS CloudTrail Console.
  • Click Roles.
  • Click Event history
  • In the Filter section, select Event name
  • Type GenerateDataKey into the search bar, Press Enter Monitoring KMS

    To establish a filter, go to filter area, select “Event name”, and set the name as “GenerateDataKey”. Press “Enter” while still on the “Enter Event Name”, leaving “Select time range” as it is. Alternatively, you could select a time range if you wish.

AWS KMS Real time notifications with AWS CloudTrail, Amazon EventBridge and Amazon SNS.

  1. Go to AWS SNS Console.
  • Click Topics.
  • Click Create topic. Monitoring KMS
  1. In the Details section
  • In the Type section, Select Standard
  • In the Name section, Type snsworkshop Monitoring KMS
  1. Drag the screen down, Click Create topic Monitoring KMS
  2. Save the information of the ARN Monitoring KMS
  3. Go to AWS SNS Console.
  • Click Subscriptions.
  • Click Create subscription. Monitoring KMS
  1. In the Create subscription page
  • In the Name section, Type Topic ARN we have saved in step 4
  • In the Protocol section, Select Email
  • In the Endpoint section, Type your email
  • Click Create subcription Monitoring KMS
  1. After some minutes, you will be received an email to confirm subscription.
  • Click Confirm subscription Monitoring KMS
  1. Go to AWS EventBridge Console.
  • Click Rules.
  • Click Create rule. Monitoring KMS
  1. In the Rule detail page
  • In the Name section, Type kmsworkshop-rule
  • Click Next Monitoring KMS
  1. In the Event pattern section
  • In the AWS service section, Select CloudTrail
  • In the Event type section, Select AWS API Call via CloudTrail
  • Click Specific operation(s)
  • Type GenerateDataKey Monitoring KMS
  1. Drag the screen down Click Next Monitoring KMS
  2. In the Select target(s) page
  • In the Select a target section, Select SNS Topic
  • In the Topic section, Select snsworkshop
  • Click Next Monitoring KMS
  1. In the Configure tags page
  • Click Next Monitoring KMS
  1. In the Configure tags page
  • Drag the screen down, Click Create rule Monitoring KMS

After creating this rule, Everytime a Data Key is generated, you wil be notified in the email address you provided.

AWS KMS And CloudWatch Metrics

In Amazon Cloudwatch you also have metrics avaiable about the AWS KMS service and CMKs.

When you import key material into a CMK and set it to expire, AWS KMS sends metrics and dimensions to CloudWatch.

  1. To check metrics and dimensions
  1. Click Per-Key Metrics Monitoring KMS
  2. We will find the metric SecondsUntilKeyMaterialExpiration for your CMK built with imported key material.

    With this metric you can now build an alarm into CloudWatch to warn you about the expiration of the key material.

    Monitoring KMS