Ravi Sir's Cards › AWS
KMS + VPC endpoint
This revision card explains KMS + VPC endpoint. It starts from the need that AWS-owned key + public path leave audit and network gaps. It describes CMK (KMS) for table SSE + Gateway VPC endpoint for DynamoDB. The how-to section covers how to create CMK , then encrypt table , then endpoint policy , then block 0.0.0.0/0. An example on the card is finance labs ask CMK rotation and private hops together.
Read card text
What this card says
Why do we need it?
AWS-owned key + public path leave audit and network gaps.
What is it?
CMK (KMS) for table SSE + Gateway VPC endpoint for DynamoDB.
kms:Decrypt
How to do it
Create CMK → encrypt table → endpoint policy → block 0.0.0.0/0.
Example
Finance labs ask CMK rotation and private hops together.