By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Backing up KMS Keys

0

I am using a few custom KMS keys to encrypt data in S3 and RDS.

Assume that the account was compromised, and a bad actor deleted the KMS keys. I know the keys can be recovered during the scheduled deletion period for the moment let's assume that if I am unable to recover the account before the scheduled deletion period expired, I will completely lose the KMS key. Any data encrypted using this key would be unrecoverable.

I want to know if there is a way to backup KMS keys let's say to another AWS account. Or is there any other way to prevent this situation?

I know this is an edge case but any guidance in this matter is highly appreciated.

Thanks

  • AndyFern95
    6 months ago

    Hi Bisina, I'm a PM at HYCU. We offer a script-free backup for KMS that allows you to restore keys, policies, aliases, tags, and even key rotations. You can customize policies, store them in S3, and restore them when needed. I'm happy to provide a trial for you to check this out.

Topics
Security, Identity, & ComplianceManagement & Governance
Tags
AWS Key Management ServiceAWS Account Management
Language
English
profile picture
Bisina
asked a year ago3089 views
2 Answers
1
Accepted Answer

I don’t believe there is away to recover KMS keys. However if this is a concern, what you can do is some of the following:-

  1. create CW alerts when KMS keys are scheduled for deletion and review
  2. create SCP policies to prevent KMS key deletion
  3. Replicate S3 data to another bucket in another account
  4. Utilise aws backup and backup objects to a vault

Gary

profile picture
EXPERT
Gary Mclean
answered a year ago
  • Bisina
    a year ago

    Yes, SCPs will be a workable solution for this. Thanks

  • Zubair Riaz
    8 months ago

    Hi I have a query regarding this In case of a whole aws region lost, what would happen our records in KMS, Certificate Manager and Route 53?

    • Will we able to use them from another region even the regions we created them is lost? or they will be lost together with region?
    • Since we can't backup KMS keys, what would be the action to mitigate the risk of loosing whole region?
0

Hello All,

Is there any new development to this question? We need to backup the kms keys that encrypt our backups, what are our options?

Abhineet

Abhineet Singh Bhamra
answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content