Ravi Sir's Cards › AWS
CMK vs AWS managed
This revision card explains CMK vs AWS managed. It starts from the need that compliance may require key policies, rotation evidence, and cross-account control. AWS managed keys are easy; customer managed keys (CMK) give key policies, grants, and clearer ownership. The how-to section covers how to use CMK for production secrets; separate keys per env; least-privilege key policy. An example on the card is finance account decrypts only with finance CMK; marketing role is denied by key policy.
Read card text
What this card says
Why do we need it?
Compliance may require key policies, rotation evidence, and cross-account control.
What is it?
AWS managed keys are easy; customer managed keys (CMK) give key policies, grants, and clearer ownership.
CMK
How to do it
Use CMK for production secrets; separate keys per env; least-privilege key policy.
Example
Finance account decrypts only with finance CMK; marketing role is denied by key policy.