Skip to content

Cryptographic Key Management (KMS)

KMS (Key Management Service) keys are used to encrypt and decrypt sensitive data within solutions. Proper handling of these keys is crucial to maintaining the security and integrity of data.

Overview & Regulatory Compliance

This document specifies the technical standards and governance for Key Management Services (KMS) used across our solutions. All data at rest across infrastructure and managed services is encrypted using customer-managed or cloud-provider default KMS keys.

Technical Key Specifications

We utilize symmetric encryption keys provided by AWS Key Management Service (AWS KMS) and Scaleway Key Manager.

Parameter Specification
Algorithm AES (Advanced Encryption Standard)
Key Size 256-bit
Cipher Mode GCM (Galois/Counter Mode)

Key Architecture & Envelope Encryption

To secure data at scale without over-exposing root keys, both AWS KMS and Scaleway KMS employ Envelope Encryption:

  • Key Encryption Keys (KEKs): Root KMS symmetric keys (AES-256-GCM) are generated and stored securely inside the cloud provider's Hardware Security Module.
  • Data Encryption Keys (DEKs): Unique temporary keys generated per data payload or storage block.
  • Execution: The DEK encrypts raw data locally, while the KMS KEK encrypts the DEK. Only encrypted DEKs are stored alongside payloads.

Lifecycle & Governance Controls

To comply with TISAX requirements regarding key lifecycle control:

  • Access Control & Least Privilege
  • AWS: Access to KMS keys is enforced via strict IAM policies and Key Policies, ensuring operational segregation between security administrators and application service roles.
  • Scaleway: Managed via Scaleway IAM policy rules scoped to specific Projects.
  • No Plaintext Export: Direct export of symmetric KMS root keys in plaintext is technically blocked by default hardware security controls.
  • Key Rotation
  • AWS KMS: Automatic annual key rotation is enabled for Customer Managed Keys (CMKs).
  • Scaleway KMS: Key rotation policies are enforced according to our internal rotation schedule.
  • Auditability & Traceability
  • Every cryptographic call (Encrypt, Decrypt, GenerateDataKey) is logged in immutable cloud audit logs:
    • AWS: Logged automatically via AWS CloudTrail.
    • Scaleway: Logged automatically via Scaleway Cockpit / Audit Logs.
  • Audit logs record the calling identity (IAM role/user), timestamp, key ID, and action taken.

Deletion Protection, Retention, and Restoration Procedures

To prevent catastrophic data loss caused by accidental or malicious key deletion, both AWS KMS and Scaleway KMS enforce a mandatory pending deletion period (waiting window). Symmetric root keys are never deleted instantly.

Once the 7-day window expires, the root key material is permanently destroyed from the HSM.

Key Protection & Retention Controls

  • Mandatory Retention Period: When a key deletion is requested, it enters a 7-day pending deletion retention state. During these 7 days, the key material remains stored safely inside the provider's HSM, but is disabled for standard encryption/decryption operations.
  • Key Protection (Scaleway): Scaleway KMS features an explicit Key Protection toggle. Keys with active protection cannot be scheduled for deletion until the toggle is manually disabled by an authorized IAM principal.
  • Alerting & Monitoring: Initiating a key deletion triggers automated audit events (kms:ScheduleKeyDeletion in AWS CloudTrail / Scaleway Cockpit).

Restoration Procedure (Incident Response Workflow)

If a key is accidentally scheduled for deletion, it can be fully restored to an active state at any point before the 7-day retention period expires.

Step 1: Detect and Validate Impact

Identify the affected Key ID via CloudTrail/Cockpit audit logs. Verify which workloads or storage volumes are impacted.

Step 2: Cancel Pending Deletion (AWS KMS)

An authorized administrator cancels the deletion request: * AWS Management Console: Navigate to KMS > Customer Managed Keys, select the key in state Pending deletion, and choose Key Actions > Cancel Key Deletion. * AWS CLI: Run aws kms cancel-key-deletion --key-id <Key-ID>.

Step 3: Recover Key (Scaleway KMS)

An authorized administrator recovers the key from the Scaleway console: * Navigate to Key Manager > Scheduled for Deletion. * Select the target key and click Recover Key.

Step 4: Re-enable Key & Verify Workloads

If the key status was set to Disabled during recovery, manually re-enable the key and test application read/write capabilities to ensure data decryption succeeds.

FAQ

Can an administrator download the raw KMS root key?

No, the AES-256 keys are bound to Hardware Security Modules and plaintext root material cannot be exported.

How do you verify key access?

All API interactions with AWS KMS and Scaleway KMS are automatically logged to CloudTrail / Cockpit audit logs.