Strengthening security and increasing control with CMEK and API key roles

This post details the implementation of Customer-Managed Encryption Keys (CMEK) and Role-Based Access Control (RBAC) with API key roles. For CMEK, it explains the hierarchical encryption system involving Key Encryption Keys (KEKs) and Data Encryption Keys (DEKs), the role of the encryption service in managing data at rest and in transit, and the process of accessing customer keys via AWS IAM roles. It also describes the key revocation experience and the benefits for compliance and visibility. For RBAC, it introduces six new roles, three for the control plane and three for the data plane, to provide more granular access control.