AWS Key Management Service (KMS) is a fully managed service that makes it easy to create and control encryption keys to encrypt your data. In this Challenge Cloud Lab, you will work hands-on with a customer-managed KMS key (CMK) to enforce encryption across multiple AWS services, EBS, S3, and DynamoDB. This ensures data is protected both in transit and at rest.
Rather than walking through each step, this Challenge Cloud Lab tests your ability to design, configure, and validate a robust encryption architecture. You must prove that only principals with appropriate KMS permissions can attach or read encrypted EBS volumes, perform dual-layer S3 encryption, and scan a DynamoDB table encrypted under your CMK.
The following is the high-level architecture diagram of the infrastructure that you’ll create in this challenge:
