Built Encryption From Scratch Before Using AWS KMS — Here's What I Learned
Most developers treat AWS KMS like a simple switch: enable it, use it, and move on. But building encryption from scratch changes how you understand security.
I spent 72 hours building a zero-dependency encrypted vault in Python using only the standard library. I implemented PBKDF2 for key derivation, HMAC-SHA256 for integrity verification, nonce-based envelope encryption, and a tamper-evident audit ledger.
The goal wasn't to create a production-ready cryptography library. It was to understand encryption deeply enough to reason about its security and failure points.
1. Key Derivation Is More Important Than It Looks
When implementing PBKDF2 yourself, you have to make decisions such as how many iterations to use.
A lower iteration count makes key derivation faster but can make brute-force attacks easier. A higher count improves resistance but increases computation time.
Testing different iteration counts made the security-versus-performance tradeoff very clear.
AWS KMS abstracts these decisions, which is one of its biggest advantages. But understanding what is happening underneath makes services such as key rotation, key hierarchies, and data keys much easier to understand.
2. Envelope Encryption Makes KMS Easier to Understand
My vault used envelope encryption.
The basic idea is:
Master Key → Data Key → Encrypted Data
Instead of using one master key directly to encrypt every piece of data, a separate data key is used for the actual encryption. The data key itself is protected by the master key.
This is also the fundamental idea behind AWS KMS envelope encryption.
After implementing this pattern myself, AWS KMS documentation became much easier to understand because I could connect the concepts to a problem I had already solved.
3. Audit Logs Need Tamper Detection
I also created a SHA-256 chained audit ledger.
Each log entry contains information connected to the previous entry through hashing. This means that modifying or removing an entry can be detected because the chain no longer matches.
The first implementation taught me an important lesson: you need to carefully decide exactly what information is protected by the integrity mechanism.
This made me understand why log integrity and tamper detection are important when working with cloud security and services such as AWS CloudTrail.
4. Start With the Threat Model
One of the biggest lessons was that security controls should be designed around the threat model.
Initially, I focused heavily on protecting the stored data while overlooking threats such as brute-force attacks against the interface.
That showed me that protecting data at rest is only one part of security.
Different AWS services solve different security problems:
- KMS → encryption and key management
- IAM → identity and access control
- WAF → protection against certain web-layer attacks
- CloudTrail → activity and audit logging
These services complement each other rather than replacing one another.
What Changed About How I Think About AWS Security
After building the project, I started asking different questions when configuring security services.
Instead of simply asking whether a security feature is enabled, I ask:
- What threat does this control protect against?
- Who can access the key?
- What happens if a credential is compromised?
- What is the potential blast radius?
- Can I detect if an audit log has been modified?
These questions help turn security configuration from simply enabling features into actually understanding the security architecture.
Final Takeaway
You don't need to build your own cryptography library to use AWS KMS effectively.
However, understanding what happens underneath the abstraction can significantly improve the way you work with cloud security services.
Building something yourself—even as a learning project—can make concepts such as key management, encryption, integrity, logging, and threat modeling much easier to understand.
The biggest lesson for me was simple:
Don't just learn what an AWS security service does. Understand the problem it was designed to solve.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article