AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your content.
The primary resources in AWS KMS are customer master keys (CMKs). These are either customer-managed or AWS-managed. You can use either type of CMK to protect data encryption keys (or data keys) which are then used to encrypt or decrypt content stored by Alfresco Content Services in AWS S3. CMKs never leave AWS KMS unencrypted, but data keys can.
For more details, see the information on AWS KMS Concepts and How Envelope Encryption Works with Supported AWS Services in the AWS documentation.
To learn more about how AWS KMS uses cryptography and secures master keys, see the AWS Key Management Service Cryptographic Details whitepaper.
The S3 Connector provides the following encryption options:
| Property setting | Description |
|---|---|
| connector.s3.encryption | Setting connector.s3.encryption=none means content stored in S3 is unencrypted. Note: Storing your content unencrypted isn’t recommended. |
| connector.s3.encryption=aes256 | The content store is encrypted using AWS managed encryption. |
| connector.s3.encryption=kms | The content store is encrypted using AWS KMS managed encryption. |
For more information about each of these encryption options, see the Encryption overviewEncryption overview.
You can configure AWS KMS by adding the relevant properties to the global properties file.