Ravi Sir's Cards › AWS
Customer-managed KMS
This interview card covers Customer-managed KMS. AWS-owned key hides who can decrypt in CloudTrail. SSE-KMS with your CMK; grant kms:Decrypt only to roles. MNC — rotate CMK schedule + deny Decrypt outside app role.
Read card text
What this card says
What it is
AWS-owned key hides who can decrypt in CloudTrail.
Why it matters
SSE-KMS with your CMK; grant kms:Decrypt only to roles.
SSE-KMS
How / example
MNC: rotate CMK schedule + deny Decrypt outside app role.
MNC: CMK audit.