KMS
Last updated: Nov 4, 2026
Rationale
AWS KMS (Key Management Service) is the service that Fluid Attacks uses to keep and use cryptographic keys. With it, Fluid Attacks has symmetric and asymmetric private keys that no user, process, or service can read, in the cloud.
These are the primary reasons why Fluid Attacks selected it and not other alternatives:
- It integrates with other AWS services, for example, DynamoDB, EKS, S3, and EBS.
- It uses a state-of-the-art approach for encryption and decryption that does not expose the keys. Users send the data that they want to encrypt or decrypt, and KMS returns it encrypted or decrypted. Thus, keys do not go out of KMS. This approach decreases the risk of key leaks very much, because the only method to get plaintext keys is brute-force attacks.
- It complies with some certifications from ISO and CSA. Many of these certifications make sure that the entity uses best practices for secure cloud-based environments and information security.
- It uses hardware security modules validated under FIPS 140-3. Thus, no user, process, or service can get the keys. KMS does not write these keys to disk. The keys are only in volatile memory, for the time that is necessary to process requests.
- It gives a centralized key vault with full API support. In this vault, Fluid Attacks can keep AWS and customer-managed keys, rotate them, log and monitor them, set deletion waiting periods, and more.
- It supports a fully granular authentication and access control model. Each key has a policy that sets which actions users can do. Also, together with AWS IAM, Fluid Attacks can set permissions for general actions, for example, to make keys.
- Fluid Attacks can write keys and permissions as code with Terraform.
- It integrates with Sops. Thus, Fluid Attacks can use its keys to encrypt its versioned secrets.
Alternatives
- Google Cloud Key Management: It was not available when Fluid Attacks moved to the cloud. It does not integrate with other AWS services. Thus, to use it, Fluid Attacks must move all of the Fluid Attacks platform.
- Azure Key Vault: It was not available when Fluid Attacks moved to the cloud. It does not integrate with other AWS services. Thus, to use it, Fluid Attacks must move all of the Fluid Attacks platform.
Usage
Fluid Attacks uses AWS KMS for these items:
- DynamoDB encryption at rest
- S3 server-side encryption
- Encryption and decryption of its Sops secrets
- Encryption and decryption of the EBS disks of its Kubernetes workers
- Encryption and decryption of the EBS disk with its ERP data
- Encryption and decryption of the EBS disks of the GitLab CI runner managers and workers, and the Batch workers, with the AWS managed key of EBS
- Encryption and decryption of the EBS disk of its Okta RADIUS Agent