Key management - Landing Zone Accelerator on AWS
All accountsManagement accountLogArchive accountAudit account

Key management

Architecture diagram showing key management for accounts.

Landing Zone Accelerator on AWS architecture – key management

The solution uses AWS KMS keys to provide encryption at rest capabilities for resources deployed by the solution. Some AWS KMS keys are deployed to every account and Region managed by the solution, while others are centralized in a single core account. 

All accounts

  • Amazon CloudWatch key – used to encrypt CloudWatch Logs groups created by the solution

  • Amazon S3 key – used to encrypt Amazon S3 buckets created by the solution

  • AWS Lambda key – used to encrypt environment variables for Lambda functions created by the solution

  • AWS Systems Manager Session Manager key (optional) – used to encrypt Session Manager sessions if Session Manager logging is activated in the global-config.yaml file

  • Amazon Elastic Block Store (Amazon EBS) key (optional) – used for default encryption of Amazon EBS volumes if activated in the security-config.yaml file

Management account

  • Installer key – created by AWSAccelerator-InstallerStack to activate encryption at rest for Installer pipeline dependencies

  • Management key – created by AWSAccelerator-PipelineStack to activate encryption at rest for Core pipeline dependencies

  • AWS Backup key (optional) – used to activate encryption at rest for AWS Backup vault if configured in the organization-config.yaml file

LogArchive account

  • Central logs key – used to encrypt the aws-accelerator-central-logs Amazon S3 bucket

    Note

    This key is distinct from the per-account/Region key because additional services such as Config, CloudTrail, and log delivery require access. Macie, GuardDuty, and Audit Manager might also require access, if activated.

  • Log replication key – used to encrypt a Kinesis Data Stream used as a destination for log replication from CloudWatch Logs to Amazon S3

Audit account

  • Accelerator KMS key – used by the entire organization to decrypt AWS Systems Manager parameters (SSM parameters) stored centrally in the Audit account

  • Audit S3 key – used to encrypt authorize-created CloudTrail Amazon S3 buckets and Audit Manager publishing bucket, if configured

  • Amazon SNS key (optional) – used to encrypt Amazon SNS topics created to alert on security events, if configured