Choose who can unlock your data — KMS and S3

Your goal

Plan encrypted file storage and control who can decrypt the files.

Why this matters

Encryption protects stored data, but a working app still needs permission to use the right key. You will choose key management, inspect two permission layers, and avoid losing a needed key.

Words you will use

Encryption turns readable data into protected data. A key helps encrypt or decrypt it. KMS manages encryption keys and rules for their use.

How to proceed

Read each situation and choose an answer. The lesson explains the result. Try again if needed, then continue through all three decisions and finish the tour.

1. Manage the encryption key

Your team wants to use a managed encryption key with supported AWS storage. You need control over which roles can use it. Choose the service.

What is KMS designed to manage?

Encryption keys and permission to use them.

KMS helps manage keys used by supported services and apps. Keeping key access limited matters as much as switching on encryption.

The design includes a managed key and its access rules.

Storage encryption → KMS key → key-use policy

2. Check both permissions

A role can read an S3 object but cannot decrypt it with the KMS key used for the object. Choose what to inspect instead of making the file public.

What permission may be missing?

The required KMS decrypt access for that key.

Storage access and key use are separate checks. Inspect the role, the key policy, and any other rules that apply. Broad public access is not a useful repair.

The investigation checks both the file permission and key permission.

S3 read permission + required KMS decrypt permission

3. Protect the recovery path

Someone proposes deleting a key still used by important encrypted data. You need to understand the consequence before approving anything.

What should the team check first?

Which data still needs the key and whether it can be recovered.

Deleting a required key can make data unreadable. Review dependencies, backups, and the deletion waiting period carefully. Test recovery while the key is still available.

The team keeps needed keys available for data recovery.

Find dependent data → verify recovery → review key lifecycle

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.