Creating an Data Encryption Key (DEK)

To create a Data Encryption Key:

1. Log in to the AWS environment.

2. Navigate to Services.

   A list of AWS services appears.

3. In Security, Identity, & Compliance, click Key Management Service.

   The AWS Key Management Service (KMS) console opens. By default, the Customer managed keys screen appears.

4. Click Create key.

   The Configure key screen appears.

5. In the Key type section, select the Asymmetric option to create a single customer master key that will be used to perform the encrypt and decrypt operations.

6. In the Key usage section, select the Encrypt and decrypt option.

7. In the Key spec section, select one option.

   For example, select RSA_4096.

8. In the Advanced options section, select the Single-Region Key option.

9. Click Next.

   The Add labels screen appears.

10. In the Alias field, specify the display name for the key, and then click Next.

    The Review and edit key policy screen appears.

11. Click Finish.

    The Customer managed keys screen appears, displaying the newly created customer master key.

12. Click the key alias.

    A screen specifying the configuration for the selected key appears.

13. In the General Configuration section, copy the value specified in the ARN field, and save it on your local machine.

    You need to attach the key to the KMSDecryptAccess policy. You also need to specify this ARN value in the command for creating a Kubernetes secret for the key.

14. Navigate to Services > IAM.

15. Click Policies.

    The Policies screen appears.

16. Select the KMSDecryptAccess policy.

    The Permissions tab appears.

17. Click Edit policy to edit the policy in JSON format.

18. Modify the policy to add the ARN of the key that you have copied in step 13 to the Resource parameter.

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "VisualEditor0",
                "Effect": "Allow",
                "Action": "kms:Decrypt",
                "Resource": [
                    "<ARN of the AWS Customer Master Key>"
                ]
            }
        ]
    }
    

19. Click Review policy, and then click Save changes to save the changes to the policy.