KMS keys, key policies and envelope encryption

SCS-C03 · Data Protection · Updated

How KMS key policies, grants and key types work, how S3, EBS and Secrets Manager use KMS, and what happens on deletion or imported key material.

This lesson is part of full SCS-C03 access

The first 2 SCS-C03 lessons are free. Full access opens every lesson with its practice questions, and the exam-style SCS-C03 question bank.

In this lesson
  • Key types
  • Envelope encryption
  • Key policy rules
  • Grants and deletion
  • Imported key material
  • Auditing
  • Exam traps
  • Practice questions

Get full access Try the free practice exam Log in

SCS-C03 course outline

All 6 lessons · Course overview
  1. GuardDuty, Security Hub, Macie and InspectorDetection Free
  2. Incident response and containment on AWSIncident Response Free
  3. WAF, Shield, Firewall Manager and Network FirewallInfrastructure Security Full access
  4. IAM policy evaluation, SCPs and cross-account accessIdentity and Access Management Full access
  5. KMS keys, key policies and envelope encryptionData Protection Full access
  6. CloudTrail, Config and organization governanceSecurity Foundations and Governance Full access