training/data/raw/aws-devops-agent-security-encryption-at-rest-for-devops-agent.md

Encryption at rest for AWS DevOps Agent

AWS DevOps Agent encrypts all customer data at rest. By default, AWS owned keys are used at no additional charge. You can optionally use a customer managed KMS key.

Customer managed keys

You can specify a customer managed key when creating:

• Agent Space – Encrypts Agent Space details, investigations, skills, and chat
• Service – Encrypts third-party service credentials

Step 1: Create a customer managed key

Requirements:

Property	Requirement
Key type	Symmetric
Key spec	SYMMETRIC_DEFAULT
Key usage	ENCRYPT_DECRYPT

Step 2: Set the key policy

Required KMS actions: kms:DescribeKey, kms:GenerateDataKey, kms:Decrypt, kms:Encrypt, kms:ReEncrypt

Grant permissions to both caller credentials (synchronous operations) and aidevops.amazonaws.com service principal (asynchronous operations like investigations).

Step 3: Specify the key when creating a resource

In console: Advanced Configuration > Encryption key type > Customer managed key In API: Include kmsKeyArn parameter

Encryption context

{
  "aws-crypto-ec:aws:aidevops:arn": "arn:aws:aidevops:{region}:{accountId}:{resourceType}/{resourceId}"
}

Key management

• Disabling/deleting KMS key prevents data access
• Cannot change key after resource creation
• Monitor key usage via CloudTrail