Using AWS KMS to manage secret keys

Question

For my use case, I need to maintain a secret key with the client to generate and verify HMAC for requests.

We can have multiple clients and we can not make assumptions such as a client's server will always reside in EC2.

I am considering envelop encryption for our secret keys using AWS KMS. I have the following concerns:

1. Secret key will be transferred over the wire as plain text to be encrypted and after decryption by KMS, is this a safe practice?

2. We will need to store AWS credentials in plain text on servers (our server as well as client's) to call KMS, how is it better than storing the secret key itself? (Given that we could share the secret key once, say in a registration successful email)

Answer 1

AWS is complicated, and most of the details are not in scope for this site.

We will need to store AWS credentials in plain text on servers (our server as well as client's) to call KMS, how is it better than storing the secret key itself? (Given that we could share the secret key once, say in a registration successful email)

You said clients might not be on EC2, which I interpret to imply that your servers will be. AWS is designed so that EC2 instances can authenticate with services like KMS without you having to store secrets in them—rather, EC2 can issue ephemeral credentials to your instances when it creates them.

That doesn't however by itself solve how to make sure that your EC2 instances and your clients will be able to share a secret key, or whether that's a good idea in the first place for your problem space. I think you need to find an AWS consultant and possibly a cryptographic engineer.

Secret key will be transferred over the wire as plain text to be encrypted and after decryption by KMS, is this a safe practice?

The connection to KMS is encrypted.