Tuesday, May 5, 2026

Cohort 3 | Project CloudIgnite Topics: Public Key Infrastructure (PKI), SSL/TLS, Certificate Management, AWS KMS Lab, Identity & Access Management Duration: ~3 hours

Key Takeaways

• PKI: asymmetric encryption — public key encrypts, private key decrypts
• SSL/TLS handshake: server sends public key → client encrypts symmetric key → server decrypts → both share symmetric key
• Digital certificates: CA-signed (trusted globally) vs self-signed (internal only); certificates expire and can be revoked
• AWS Certificate Manager (ACM): manages SSL/TLS certificates; automates renewal
• AWS KMS Lab 278: Created symmetric KMS key, encrypted/decrypted files using AWS Encryption SDK CLI on EC2 via SSM
• IAM: Identification → Authentication → Authorization → Accounting; MFA adds extra layer
• Authentication factors: something you know (password), something you have (token), something you are (biometrics)

🔐 1. Public Key Infrastructure (PKI)

What is PKI? A collection of technologies used to apply cryptographic principles. It maintains confidentiality, integrity, non-repudiation, and authenticity.

PKI is part of the Prevention phase in the security cycle: Prevention → Detection → Response → Analyze → (back to Prevention)

🔑 Asymmetric Encryption (Public/Private Key)

• Uses two different keys: a public key and a private key
• Public key → encrypts the message
• Private key → decrypts the message
• These two keys are completely different — you cannot use the same key to both encrypt and decrypt

💡 Key rule: If encrypted with public key → only private key can decrypt. If encrypted with private key → only public key can decrypt.

🤝 SSL/TLS Key Exchange (Simplified Flow)

This is how a secure session is established between a client and server:

1. Server generates a public key + private key pair
2. Server sends the public key to the client
3. Client generates a symmetric key (let's call it K)
4. Client encrypts K using the server's public key
5. Encrypted K is sent to the server
6. Server decrypts the encrypted K using its private key
7. Both client and server now share K → they use it to encrypt all further communication

🛡️ Why is this secure? Even if someone intercepts the public key, they cannot decrypt the symmetric key — only the server's private key can do that. The public key is fine for everyone to know.

More advanced version: Diffie-Hellman (DH) — both client and server have their own public/private key pairs. More complex, but same principle.

📜 Digital Certificates

• An electronic credential that represents the identity of an individual, computer, or organization
• Contains: public key, owner info, expiry date, policy/principal
• Used to enable HTTPS — without a certificate, you can only use unencrypted HTTP

Types of certificates:

🏛️ Certificate Authorities (CA)

Two types:

CA Hierarchy:

• Root CA — top-level authority; initializes and stores everything
• Subordinate CA — registers, verifies, and validates certificates (controlled by Root CA)

Certificate Lifecycle:

• Certificates have an expiry date (e.g., Let's Encrypt = ~90 days)
• Can be revoked if: private key is compromised, or operational reasons
• Revoked certificates are tracked in a Certificate Revocation List (CRL)

🛠️ AWS Certificate Manager (ACM)

• AWS service to manage SSL/TLS certificates
• Can automate renewal to prevent downtime
• Can send notifications before expiry (e.g., 30 days or 10 days before)
• Stores certificates securely; integrates with EC2 and other AWS services

🔒 2. AWS KMS Lab (Lab 278)

AWS Key Management Service (KMS) — used to create, store, and manage encryption keys.

Lab Steps Summary:

1. Create a KMS Key — symmetric key (one key for both encrypt + decrypt); assign alias (e.g., my-kms-key)
2. Set Key Administrator — assign the voclabs IAM role
3. Copy the ARN (Amazon Resource Name) — unique identifier for your key; needed for CLI commands
4. Connect to EC2 via SSM Session Manager (no SSH needed)
5. Run aws configure — set access key, secret key, and default region (e.g., us-west-2)
6. Edit credentials file (~/.aws/credentials) — paste the AWS CLI key
7. Install AWS Encryption SDK CLI
8. Encrypt a file using KMS key ARN
9. Decrypt the file using the same key ARN
10. Verify using echo $? — 0 = success

⚠️ Lab Issue Encountered: EC2 instance had Python 3.7 but AWS Encryption SDK required 3.8. Workaround: install older version of the SDK (< 4) or upgrade Python to 3.8.

Useful commands:

cd ~                          # navigate to home directory
aws configure                 # set up AWS CLI credentials
vi ~/.aws/credentials         # edit credentials file
mkdir output                  # create output folder
KEY_ARN="arn:aws:kms:..."     # store ARN as variable
echo $KEY_ARN                 # verify variable
echo $?                       # check if last command succeeded (0 = success)
cat <filename>                # view file contents
ls output/                    # list files in output folder

👤 3. Identity & Access Management (IAM)

The AAA + Identification Framework

🔐 Authentication Factors

Something you know: Password, PIN

Something you have: Smart card, token, USB key, virtual card, passkey on smartphone

Something you are (Biometrics): Fingerprint, facial recognition, retina scanner, iris scanner

Multi-Factor Authentication (MFA): Adds an extra layer — even if password is compromised, attacker still can't log in.

🗝️ Password Policies (Best Practices)

Strong password requirements:

• Minimum 8 characters
• At least 1 uppercase, 1 lowercase, 1 number, 1 special character

Dictionary Attack: Attackers use a list of common words/passwords and try them all automatically. Mitigated by:

• CAPTCHA
• Login attempt limits
• Using strong, unique passwords per site

⚠️ Risk: Wi-Fi handshake packets can leak a hash value — offline dictionary attacks can then be attempted with no rate limiting.

🧩 Personally Identifiable Information (PII)

Examples of PII:

• Name, government ID number, date of birth
• Billing address, phone number
• Fingerprint, retina scan, account numbers

AWS tool tip: Amazon SageMaker (and other AI tools) can be used to automatically detect and redact PII from stored data.

🔑 Password Managers

• Use different passwords for different websites
• If one site is breached, other accounts aren't compromised
• Password managers encrypt stored passwords and decrypt on demand
• You can build your own with Python or Bash
• Prefer open-source password managers for transparency

☁️ CLF-C02 Exam Relevance

The following topics from today's lecture are directly relevant to the AWS Certified Cloud Practitioner (CLF-C02) exam:

📝 Study tip: For CLF-C02, you don't need to memorize CLI commands or deep cryptography math. Focus on what each service does, when to use it, and why it improves security.

📅 Next Session

• Tomorrow: Finish remaining IAM slides → AWS IAM deep dive → Lab 279
• Saturday 2PM (or anytime in the morning): Redo Lab 278 (KMS encryption/decryption lab) for those who ran out of time or faced Python version issues