Using encryption context

An encryption context is an optional set of key-value pairs that contain additional contextual information about the data. AWS KMS uses the encryption context to support authenticated encryption.

When you include an encryption context in an encryption request, AWS KMS binds the encryption context to the encrypted data. To decrypt data, you include the same encryption context in the request.

Voice analytics uses the same encryption context in all AWS KMS cryptographic operations, where the key is aws:chime:voice-profile-domain:arn and the value is the resource Amazon Resource Name (ARN).

The following example shows a typical encryption context.

"encryptionContext": {
    "aws:chime:voice-profile-domain:arn": "arn:aws:chime:us-west-2:111122223333:voice-profile-domain/sample-domain-id"
}

You can also use the encryption context in audit records and logs to identify how the customer managed key is being used. The encryption context also appears in logs generated by CloudTrail or CloudWatch Logs.

Using encryption context to control access to your key

You can use the encryption context in key policies and IAM policies as conditions to control access to your symmetric customer managed key. You can also use encryption context constraints in a grant.

Voice analytics uses an encryption context constraint in grants to control access to the customer managed keys in your account or Region. The grant constraint requires that the operations that the grant allows use the specified encryption context.

The following example key policy statements grant access to a customer managed key for a specific encryption context. The condition in the policy statement requires that the grants have an encryption context constraint that specifies the encryption context.

{
    "Sid": "Enable DescribeKey",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::111122223333:role/ExampleReadOnlyRole"
    },
    "Action": "kms:DescribeKey",
    "Resource": "*"
},
{
    "Sid": "Enable CreateGrant",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::111122223333:role/ExampleReadOnlyRole"
    },
    "Action": "kms:CreateGrant",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "kms:EncryptionContext:aws:chime:voice-profile-domain:arn": "arn:aws:chime:us-west-2:111122223333:voice-profile-domain/sample-domain-id"
        }
    }
}