SAA-C03
Deep Dive
Key and secret management is one of the pillars of the security domain. The exam distinguishes between when to use KMS (encryption keys), Secrets Manager (credentials with rotation) and SSM Parameter Store (configuration). Understanding this distinction is key.
Contents
AWS KMS is the central service for managing cryptographic keys. It integrates natively with S3, EBS, RDS, DynamoDB, Lambda, Secrets Manager and nearly the entire AWS ecosystem.
KMS keys are regional — a key in us-east-1 cannot be used directly in eu-west-1. For multi-region use cases, Multi-Region Keys exist.
FIPS 140-2 security
KMS uses certified HSM modules. Keys never leave the module in plaintext.
CloudTrail auditing
Every use of a key (encrypt, decrypt) generates an event in CloudTrail. Full traceability.
Automatic rotation
Customer-managed keys: optional automatic annual rotation. New key material, same Key ID.
KMS doesn't encrypt your data directly (that would be inefficient for large files). It uses envelope encryption: the CMK encrypts an ephemeral data key, and that data key encrypts your actual data.
Encryption flow
Request a data key
Your app calls KMS: GenerateDataKey. KMS returns the data key both in plaintext AND encrypted with your CMK.
Encrypt with the data key
Your app uses the plaintext data key (locally, no network call) to encrypt the data.
Discard the plaintext data key
You delete the plaintext data key from memory. You keep only: encrypted data + encrypted data key.
To decrypt
You call KMS with the encrypted data key. KMS decrypts it with the CMK and returns the plaintext data key so you can decrypt the data.
Why this matters for the exam
Envelope encryption is why KMS can scale to millions of objects. There are only 2 calls to KMS per object (GenerateDataKey when encrypting, Decrypt when decrypting) — regardless of file size.
| Key type | Created by | Control | Rotation | Cost |
|---|---|---|---|---|
| AWS Owned Keys | AWS | None | Automatic (AWS) | Free |
| AWS Managed Keys | AWS (for your account) | View policy, cannot modify | Automatic every 3 years | Free |
| Customer Managed Keys | You | Full control (policy, rotation, disable) | Manual or automatic (1 year) | $1/month + $0.03/10k requests |
| Customer Imported Keys | You (external key material) | Bring your own cryptographic material | Manual only | $1/month |
Secrets Manager stores and manages secrets (DB passwords, API keys, OAuth tokens) with automatic rotation. It encrypts secrets with KMS. Ideal for database credentials.
Key features
Signals on the exam
AWS Systems Manager Parameter Store stores configuration and simple secrets as key-value pairs. Cheaper than Secrets Manager, but without built-in automatic rotation.
Standard Parameter
Up to 4KB, free. For configuration like environment names, URLs, feature flags.
Advanced Parameter
Up to 8KB, $0.05/parameter/month. Supports policies (TTL, expiration). For larger secrets.
String
Plain text value. For non-sensitive configuration (environment name, region, etc.).
SecureString
A value encrypted with KMS. For simple secrets that don't need automatic rotation.
ACM provisions, manages and renews SSL/TLS certificates automatically. Free for certificates used with AWS services (CloudFront, ALB, API Gateway).
Automatic renewal
ACM renews certificates before they expire. Zero manual management.
AWS services only
You cannot export the private key. Only ALB, CloudFront, API Gateway.
Imported certificates
You can import third-party certificates (Let's Encrypt, etc.) if you need to export them.
Validation
DNS validation (recommended) or Email validation to prove domain ownership.
| Need | Recommended service | Reason |
|---|---|---|
| Encrypt data in S3, EBS, RDS | AWS KMS | Native integration + CloudTrail auditing |
| DB credentials with automatic rotation | Secrets Manager | Built-in rotation via Lambda for RDS/Aurora |
| Per-environment configuration variables | SSM Parameter Store (Standard) | Free, hierarchical (/prod/api/url) |
| API keys without automatic rotation | SSM Parameter Store SecureString | Cheaper than Secrets Manager if you don't need rotation |
| HTTPS certificates for ALB/CloudFront | AWS Certificate Manager | Free + automatic renewal |
| Your own cryptographic material (BYOK) | KMS Customer Imported Keys | Full control over the key material |
Did you get this topic?
Test what you just learned
An application on EC2 needs to connect to a MySQL RDS database. The credentials must rotate automatically every 30 days without restarting the application. What is the correct solution?
Put what you learned to the test with original SAA-C03 exam questions.
Start SAA-C03 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.