JobCannon
全部技能

AWS KMS Encryption

⬢ 層級 2技術
高
薪資影響
6 個月
學習時長
中等
難度
—
職業
一覽

AWS KMS (Key Management Service) manages encryption keys. Create master keys (CMK), grant permissions (who can encrypt/decrypt), and KMS handles the cryptography. Use for: S3 encryption, RDS encryption, EBS encryption, Secrets Manager. Mastery means understanding key policies, grants, key rotation, HSM backing, and compliance (HIPAA, PCI-DSS, SOC 2). Learning path: encryption concepts (1 week) → KMS setup (1 week) → key policies + grants (2 weeks) → production patterns (2 weeks).

什麼是 AWS KMS Encryption

AWS Key Management Service manages encryption keys. You create Customer Master Keys (CMK), define policies (who can use it), and KMS encrypts/decrypts data on your behalf. You never see the key material, KMS protects it in hardware security modules (optional). Use for: S3 encryption, RDS encryption, EBS snapshots, Secrets Manager, DynamoDB encryption.

🔧 工具與生態
AWS KMS ConsoleAWS SDKKey ManagementKMS Key PoliciesKMS GrantsCloudTrail AuditAWS Secrets ManagerS3 Server-Side EncryptionRDS Encryption

💰 各地區薪資

地區初級中級高級
USA$75,000$125,000$175,000
UK£45,000£75,000£115,000
EU€50,000€82,000€125,000
CANADACA$80,000CA$135,000CA$185,000

❓ 常見問題

Should I use AWS-managed or customer-managed keys?
AWS-managed: simpler, auto-rotation, AWS manages key material. Customer-managed: more control, explicit rotation, compliance. Start with AWS-managed; customer-managed if compliance requires.
What's the difference between CMK and data key?
CMK (Customer Master Key): long-lived, used to encrypt other keys. Data key: generated per request, encrypts actual data. CMK never leaves KMS; data keys do.
Do I need HSM backing?
HSM = hardware security module, higher security, higher cost ($1000+/month per key). Only if FIPS 140-2 Level 3 required (government, finance).
How do I encrypt S3 with KMS?
Create KMS key, configure S3 bucket default encryption to use that key. Objects automatically encrypted with customer-managed key instead of AWS-managed.
What's key rotation?
Regularly replace CMK with new key material for compliance. AWS-managed: auto (1 year). Customer-managed: manual or auto (recommended: annual).
How much does KMS cost?
API calls: $0.03 per 10k requests. Key storage: $1/month per CMK. Small org: $1-10/mo. Large: $100+/mo.
Is KMS suitable for production?
Yes, essential for compliance (HIPAA, PCI-DSS, GDPR). Every prod system should encrypt sensitive data.

不確定這項技能適不適合你？

做一下職業匹配，我們會推薦合適的方向。

找到最適合我的技能 →

找到理想的職業方向

在 2,521 個職業中進行技能匹配。免費。

免費做職業匹配 →