AWS Key Management Service (AWS KMS) celebrated its one-year launch anniversary in November 2015, and organizations of all sizes are using it to effectively manage their encryption keys. KMS also successfully completed the PCI DSS 3.1 Level 1 assessment as well as the latest SOC assessment in August 2015.
One question KMS customers frequently ask is: "How should I encrypt my Primary Account Number (PAN) data?" You can encrypt your PAN data using customer data keys (CDKs) that are exportable out of KMS. Alternatively, you also can use KMS to directly encrypt PAN data by using a customer master key (CMK). In this blog post, I will show you how to help protect sensitive PAN data with KMS by using the CMK via the AWS CLI.
The use of a CMK to directly encrypt data removes some of the burden of having developers manage encryption libraries. Additionally, a CMK cannot be exported from KMS, which alleviates the concern about someone saving the encryption key in an insecure location. You can also leverage AWS CloudTrail so that you have logs of the key’s use.
For the purpose of this post, I have three different IAM roles to help ensure the security of the PAN data being encrypted:
- KeyAdmin – This is the general key administrator role, which has the ability to create and manage the KMS keys. A key administrator does not have the ability to directly use the keys for encrypt and decrypt functions. Keep in mind that because the administrator does have the ability to change a key’s policy, they can change this policy to allow them to also directly use the key.
- PANEncrypt – This role allows the user only to encrypt an object using the CMK.
- PANDecrypt – This role allows the user only to decrypt an object using the CMK.
If you don’t already have a CMK that you wish to use to encrypt the sensitive PAN data, you can create one with the following command. (Throughout this post, remember to replace the placeholder text in red with your account-specific information.)
$ aws kms create-key --profile KeyAdmin --description "Key used to encrypt and decrypt sensitive PAN data" --policy file://Key_Policy
Notice the use of --profile KeyAdmin in the previous command. This forces the command to be run as a role specified within my configuration file that has permissions to create a KMS key. We will be using different roles, as defined in the following key policy (to which file://Key_Policy in the previous command refers), to manipulate and use the KMS key. For additional details about how to assume roles within the CLI, see Assuming a Role.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAccessForKeyAdministrators",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/KeyAdmin"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "AllowEncryptionWithTheKey",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/PANEncrypt"
},
"Action": [
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "AllowDecryptionWithTheKey",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/PANDecrypt"
},
"Action": [
"kms:Decrypt",
"kms:DescribeKey"
],
"Resource": "*"
}
]
}
After the new CMK is created, I can then assign it an alias so that it will be easier to identify in the future. In this case, I will create the alias SensitivePANKey, as shown in the following command.
$ aws kms create-alias --profile KeyAdmin --alias-name alias/SensitivePANKey --target-key-id arn:aws:kms:us-east-1:123456789012:key/221c9ce1-9da8-44e9-801b-faf1EXAMPLE
Now that I have a CMK with least-privilege permissions to limit who can manage and use it, I can start to use it to encrypt PAN data. To keep things simple in this post, I will be using AWS CLI commands to accomplish this, but this can also be done through an AWS SDK and incorporated into an application.
Using the PANEncrypt role, the following CLI command takes in a string of data (in this case “Sensitive PAN Data”), encrypts it using the key I created earlier in this post, and sends the Base64-encoded ciphertext into a new file called encrypted-123-1449012738. Notice that I also use EncryptionContext to further protect the encrypted data.
$ aws kms encrypt --profile PANEncrypt --key-id alias/SensitivePANKey --plaintext "Sensitive PAN Data" --query Ciphertextblog --encryption-context UserName=user@domain.com,Date=1449012738 --output text | base64 --decode > encrypted-123-1449012738
Because the EncryptionContext must be the same when I decrypt the file, I gave the file a unique name that can help us rebuild the EncryptionContext when it comes time to decrypt the object. The file name structure is: encrypted-GUID-Date. The GUID allows us to look up the user’s user name within our directory, and then I use the date as part of the context. As Greg Rubin discussed in another AWS Security Blog post, the EncryptionContext can help ensure the integrity of the encrypted data.
From here, I can use the following command to put this encrypted object in an Amazon S3 bucket.
$ aws s3 cp encrypted-123-1449012738 s3://Secure-S3-Bucket-For-PAN/ --region us-west-2 --sse aws:kms
Notice that I used SSE-S3 encryption on the object again to further protect the object at rest. For this example, I chose to use native SSE-S3 encryption, but this could have been another KMS key as well. From here, I update a database with the location of this encrypted object within the S3 bucket.
When I need to retrieve the PAN data, I can make the following CLI call to get the encrypted object from my S3 bucket.
$ aws s3 cp s3://Secure-S3-Bucket-For-PAN/ encrypted-123-1449012738 . --region us-west-2
Finally to decrypt the object, I run the following command using the PANDecrypt role.
$ echo “Decrypted PAN Data: $(aws kms decrypt --profile PANDecrypt --ciphertext-blob fileb://encrypted-123-1449012738 --encryption-context UserName=user@domain.com,Date=1449012738 --output text --query Plaintext | base64 --decode)”
Notice that I use the same EncryptionContext as I did when I encrypted the sensitive PAN data. To get this EncryptionContext, I again look up the UserName from the GUID and then include the Date. Then for the purpose of this example, I print this sensitive data to the screen, but in a real-world example, this can be passed to another application or service.
Now that I have shown that KMS can directly encrypt and decrypt sensitive PAN data, this can be rolled out as a service within an application environment. This service should actually be composed of two different component services: one that provides encryption, and another that has enhanced controls around it and is used to decrypt the sensitive data. These component services would address storage of the ciphertext, metadata, error conditions, and so on. With the integration of CloudTrail into KMS and application logs, an organization can have detailed records of the calls into the service and the use of KMS keys across the organization.
If you have questions or comments about this post, either post them below or visit the KMS forum.
- Matt