AWS KMS is now FIPS 140-2 Security Level 3. What does this mean for you?

AWS Key Administration Service (AWS KMS) lately introduced that its {hardware} safety modules (HSMs) got Federal Info Processing Requirements (FIPS) 140-2 Safety Stage 3 certification from the U.S. Nationwide Institute of Requirements and Expertise (NIST). For organizations that depend on AWS cryptographic companies, this increased safety degree validation has a number of advantages, together with less complicated arrange and operation. On this put up, we’ll share extra particulars concerning the current change in FIPS validation standing for AWS KMS and clarify the advantages to clients utilizing AWS cryptographic companies on account of this modification.

Background on NIST FIPS 140

The FIPS 140 framework supplies pointers and necessities for cryptographic modules that shield delicate data. FIPS 140 is the business normal within the US and Canada and is acknowledged world wide as offering authoritative certification and validation for the way in which that cryptographic modules are designed, carried out, and examined in opposition to NIST cryptographic safety pointers.

Organizations comply with FIPS 140 to assist be sure that their cryptographic safety is aligned with authorities requirements. FIPS 140 validation can be required in sure fields corresponding to manufacturing, healthcare, and finance and is included in a number of business and regulatory compliance frameworks, such because the Cost Card Trade Knowledge Safety Normal (PCI DSS), the Federal Threat and Authorization Administration Program (FedRAMP), and the Well being Info Belief Alliance (HITRUST) framework. FIPS 140 validation is acknowledged in lots of jurisdictions world wide, so organizations that function globally can use FIPS 140 certification internationally.

For extra data on FIPS Safety Ranges and necessities, see FIPS Pub 140-2: Safety Necessities for Cryptographic Modules.

What FIPS 140-2 Safety Stage 3 means for AWS KMS and also you

Till lately, AWS KMS had been validated at Safety Stage 2 total and at Safety Stage 3 within the following 4 sub-categories:

Cryptographic module specification
Roles, companies, and authentication
Bodily safety
Design assurance

The most recent certification from NIST implies that AWS KMS is now validated at Safety Stage 3 total in every sub-category. Consequently, AWS assumes extra of the shared accountability mannequin, which can profit clients for sure use circumstances. Safety Stage 3 certification can help organizations looking for compliance with a number of business and regulatory requirements. Although FIPS 140 validation is just not expressly required in quite a lot of regulatory regimes, sustaining stronger, easier-to-use encryption could be a highly effective instrument for complying with FedRAMP, U.S. Division of Protection (DOD) Authorised Product Checklist (APL), HIPAA, PCI, the European Union’s Basic Knowledge Safety Regulation (GDPR), and the ISO 27001 normal for safety administration greatest practices and complete safety controls.

Clients who beforehand wanted to fulfill compliance necessities for FIPS 140-2 Stage 3 on AWS had been required to make use of AWS CloudHSM, a single-tenant HSM answer that gives devoted HSMs as a substitute of managed service HSMs. Now, clients who had been utilizing CloudHSM to assist meet their compliance obligations for Stage 3 validation can use AWS KMS by itself for key era and utilization. In comparison with CloudHSM, AWS KMS is usually decrease price and simpler to arrange and function as a managed service, and utilizing AWS KMS shifts the accountability for creating and controlling encryption keys and working HSMs from the shopper to AWS. This lets you focus assets in your core enterprise as a substitute of on undifferentiated HSM infrastructure administration duties.

AWS KMS makes use of FIPS 140-2 Stage 3 validated HSMs to assist shield your keys whenever you request the service to create keys in your behalf or whenever you import them. The HSMs in AWS KMS are designed in order that nobody, not even AWS staff, can retrieve your plaintext keys. Your plaintext keys are by no means written to disk and are solely utilized in risky reminiscence of the HSMs whereas performing your requested cryptographic operation.

The FIPS 140-2 Stage 3 licensed HSMs in AWS KMS are deployed in all AWS Areas, together with the AWS GovCloud (US) Areas. The China (Beijing) and China (Ningxia) Areas don’t assist the FIPS 140-2 Cryptographic Module Validation Program. AWS KMS makes use of Workplace of the State Industrial Cryptography Administration (OSCCA) licensed HSMs to guard KMS keys in China Areas. The certificates for the AWS KMS FIPS 140-2 Safety Stage 3 validation is obtainable on the NIST Cryptographic Module Validation Program web site.

As with many business and regulatory frameworks, FIPS 140 is evolving. NIST authorised and revealed a brand new up to date model of the 140 normal, FIPS 140-3, which supersedes FIPS 140-2. The U.S. authorities has begun transitioning to the FIPS 140-3 cryptography normal, with NIST saying that they are going to retire all FIPS 140-2 certificates on September 22, 2026. NIST lately validated AWS-LC beneath FIPS 140-3 and is at present within the strategy of evaluating AWS KMS and sure occasion sorts of AWS CloudHSM beneath the FIPS 140-3 normal. To verify the standing of those evaluations, see the NIST Modules In Course of Checklist.

For extra data on FIPS 140-3, see FIPS Pub 140-3: Safety Necessities for Cryptographic Modules.

Authorized Disclaimer

This doc is offered for the needs of data solely; it isn’t authorized recommendation, and shouldn’t be relied on as authorized recommendation. Clients are answerable for making their very own impartial evaluation of the knowledge on this doc. This doc: (a) is for informational functions solely, (b) represents present AWS product choices and practices, that are topic to vary with out discover, and (c) doesn’t create any commitments or assurances from AWS and its associates, suppliers or licensors. AWS services or products are offered “as is” with out warranties, representations, or circumstances of any type, whether or not specific or implied. The tasks and liabilities of AWS to its clients are managed by AWS agreements, and this doc is just not a part of, nor does it modify, any settlement between AWS and its clients.

AWS encourages its clients to acquire applicable recommendation on their implementation of privateness and information safety environments, and extra typically, relevant legal guidelines and different obligations related to their enterprise.

AWS encourages its clients to acquire applicable recommendation on their implementation of privateness and information safety environments, and extra typically, relevant legal guidelines and different obligations related to their enterprise.

When you’ve got suggestions about this put up, submit feedback within the Feedback part under. When you’ve got questions on this put up, contact AWS Help.

Need extra AWS Safety information? Comply with us on Twitter.

Rushir Patel

Rushir is a Senior Safety Specialist at AWS, centered on information safety and cryptography companies. His purpose is to make complicated subjects easy for purchasers and assist them undertake higher safety practices. Earlier than becoming a member of AWS, he labored in safety product administration at IBM and Financial institution of America.

Rohit Panjala

Rohit is a Worldwide Safety GTM Specialist at AWS, centered on information safety and cryptography companies. He’s answerable for growing and implementing go-to-market (GTM) methods and gross sales performs and driving buyer and associate engagements for AWS information safety companies on a worldwide scale. Earlier than becoming a member of AWS, Rohit labored in safety product administration and electrical engineering roles.