Slack stores lots of customer data, and it’s essential that it’s protected. Some customers need tight control over their keys, so Slack worked with AWS KMS to enable customers to revoke data access independently. With Slack’s Enterprise Key Management (EKM) capability, customers control master keys that unlock access to their data from KMS accounts. Using precise, granular KMS access controls, customers allow or deny access to individual channels, workspaces, or Slack channels and audit keys in AWS CloudTrail logs. This session covers KMS and how Slack used KMS to build the EKM capability. Learn how KMS can help you give your customers control over their data.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cross-account encryption with AWS
KMS and Slack Enterprise Key
Management
Joe Norman
Partner Solutions Architect
AWS
S D D 3 5 3
Audrei Drummond
Staff Backend Engineer
Slack

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Defense in depth
KMS key
policy
KMS keyRole
IAM policy
Amazon S3
VPC endpoint
VPCe policy
Amazon S3 bucket
Bucket policy
Users Documents

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Encryption in AWS
Audit
Access controls
Encrypting services
Secondary
storage
Client
Corporate data
center
AWS Cloud

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Key Management Service (AWS KMS) custom key
store
Clients
AWS
services

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS KMS keyhierarchy
Two-tiered hierarchy for keys
• Data keys used to encrypt customer data
• Customer master keys (CMKs) protect data keys
• CMK policies control access to data
• All activity associated with CMKs is logged
Benefits
• Envelope encryption avoids managing data keys
• Encrypted data keys stored with encrypted objects
• Well suited to encrypting large data objects
• Enables local key caching for high I/O operations
Customer
master key
S3 bucket Amazon EBS
volume
Amazon
RDS
instance
CMK
Data key Data key Data key
AWS KMS

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Envelope encryption
Example: S3 server-side encryption
Plaintext
data
Encrypt process
Encrypted
data key
3
Data key
Data key
7
Data key
Encrypted
data key
6 Data key
Generate data key request
2
CMK
1
Amazon S3
Encrypt
Encrypted
data and
data key in
S3 bucket
4
Data key
Decrypt process
5
Encrypted
data and
data key in
S3 bucketData key
Decrypt
Amazon S3
Plaintext
data
8

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Key policies
Allow: Grants access
Deny: Revokes access
Which actors get this access
allowed or denied?
API actions allowed or denied
by the policy
Actions are taken against the
CMK this policy is attached to
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "Grant admin access to CMK",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::[myAccount#]:role/KMSAdmin"
]
},
"Action": [
"kms:*",
]
"Resource": "*",
}]
}

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Opening the floodgates
Client
Corporate data
center
AWS Cloud
VPC
Third-Party SaaS
Who controls the keys?
Customer
SaaS provider

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Diving into the SaaS side
AWS Cloud
AWS KMSCustomer
SaaS provider AWS account

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can the customer keep more control?

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can the customer keep more control?

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can the customer keep more control?

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can the customer keep more control?

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can the customer keep more control?

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can the customer keep more control?

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can the customer keep more control?

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can the customer keep more control?

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cross-account key policies
Allow: Grants access
Deny: Revokes access
All users in 3rd party AWS
account.
Make data keys to encrypt new
data and decrypt existing data
keys to decrypt previously
encrypted data.
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "Third-party access",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::111111111111:root",
"arn:aws:iam::222222222222:root"
]
},
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
]
"Resource": "*",
}]
}

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Key revocation
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "Third-party access",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::111111111111:root",
"arn:aws:iam::222222222222:root"
]
},
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
]
"Resource": "*",
},
{
"Sid": "Revoke home folder access",
"Effect": "Deny",
"Principal": {
"AWS": [
"arn:aws:iam::111111111111:root",
"arn:aws:iam::222222222222:root"
]
},
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:EncryptionContext:folder": "home"
}
}
}]}

20. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Keep an eye on key usage with AWS CloudTrail
"EventName":"DecryptResult", This KMS API action was called…
"EventTime":"2014-08-18T18:13:07Z", …at this time
"RequestParameters":
{"keyId":"2b42x363-1911-4e3a-8321-6b67329024ex"}, …in reference to this key
"EncryptionContext":"volumeid-12345", …with this context
"SourceIPAddress":" 203.0.113.113", …from this IP address
"UserIdentity":
{"arn":"arn:aws:iam:: 111122223333:user/User123"} …by this AWS user in this account

21. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Some challenges for consideration
• AWS KMS is a regional service
• Multiple regions = multiple CMKs
• Customer must trust that SaaS is deleting plaintext data keys
• Shared responsibility: Customer control over security increased
• Access control, key rotation, auditing

22. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

23. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

24. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack is the collaboration hub that moves work forward

25. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack Enterprise Grid

26. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

27. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
Bring your own keys
Slack EKM integrates with AWS KMS to give our most
security-conscious customers control over their encryption
keys.
Granular key access control
Admins can revoke key access granularly, so teams
experience minimal disruption. Slack keeps working as
usual, and so do they.
Peace of mind for the security-conscious
Helps customers manage the risk of relying on a vendor to
protect sensitive data and the risk of invisible disclosure

28. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Design objectives

29. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Design objectives
Maintain all of Slack’s features in their full and unhindered form

30. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Design objectives
Maintain all of Slack’s features in their full and unhindered form
Inspire a high level of customer trust by:
• Providing a detailed, un-tamperable audit log of key accesses
• Augmenting that with a log generated by Slack
• Restricting employee access to customers’ key material

31. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Design objectives
Maintain all of Slack’s features in their full and unhindered form
Inspire a high level of customer trust by:
• Providing a detailed, un-tamperable audit log of key accesses
• Augmenting that with a log generated by Slack
• Restricting employee access to customers’ key material
Preserve Slack’s engineers’ ability to deliver features and fixes

32. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Design objectives
Maintain all of Slack’s features in their full and unhindered form
Inspire a high level of customer trust by:
• Providing a detailed, un-tamperable audit log of key accesses
• Augmenting that with a log generated by Slack
• Restricting employee access to customers’ key material
Preserve Slack’s engineers’ ability to deliver features and fixes
Introduce minimal performance penalties

33. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

34. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM to end users

35. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM to end users

36. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM provides ...
Visibility into access to the keys that
can decrypt your messages and files
Control of key access by organization,
workspace, channel, and time

37. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

38. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM high-level design

39. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM high-level design
• Encrypt every message or file using the customer’s encryption keys

40. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM high-level design
• Encrypt every message or file using the customer’s encryption keys
• Decrypt every message or file using the same keys

41. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM high-level design
• Encrypt every message or file using the customer’s encryption keys
• Decrypt every message or file using the same keys
• Use many keys, each covering a small slice of messages or a single file

42. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM high-level design
• Encrypt every message or file using the customer’s encryption keys
• Decrypt every message or file using the same keys
• Use many keys, each covering a small slice of messages or a single file
• Give customers a log of all accesses to their keys

43. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM high-level design
• Encrypt every message or file using the customer’s encryption keys
• Decrypt every message or file using the same keys
• Use many keys, each covering a small slice of messages or a single file
• Give customers a log of all accesses to their keys
• Cache data keys for five minutes to preserve performance

44. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM high-level design
• Encrypt every message or file using the customer’s encryption keys
• Decrypt every message or file using the same keys
• Use many keys, each covering a small slice of messages or a single file
• Give customers a log of all accesses to their keys
• Cache data keys for five minutes to preserve performance
• Enable customers to control access to their keys via policies in AWS KMS

45. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
High-level design

46. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption
Log AWS KMS usage and
key scope

47. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption
Log AWS KMS usage and
key scope

48. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption

49. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption
Log AWS KMS usage and
key scope

50. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption
Log AWS KMS usage and
key scope

51. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption
Log AWS KMS usage and
key scope

52. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption
Log AWS KMS usage and
key scope

53. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption
Log AWS KMS usage and
key scope

54. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption
Your AWS Account
Log AWS KMS usage and
key scope

55. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
encryption
Your AWS Account
Enforce Key
Policy
Log AWS KMS usage
and key scope

56. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Log AWS KMS usage and
parameters

57. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Log AWS KMS usage and
parameters

58. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Log AWS KMS usage and
parameters

59. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Log AWS KMS usage and
parameters

60. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Log AWS KMS usage and
parameters

61. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Log AWS KMS usage and
parameters

62. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Log AWS KMS usage and
parameters

63. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Log AWS KMS usage and
parameters

64. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Enforce Key Policy
Log AWS KMS
usage and
parameters

65. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
decryption
Your AWS Account
Send Logs
Log AWS KMS usage and
parameters

66. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

67. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
EncryptionContext scopes data keys to data
• A message is encrypted with an encryption key that’s scoped to:
• The organization
• The workspace
• The channel
• The hour
• A file is encrypted with an encryption key that’s scoped to:
• The organization
• The file

68. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Granularly revoke key access

69. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Example policies: Baseline
{
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam::152659312504:root"},
"Action": ["kms:Decrypt", "kms:GenerateDataKey"],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:EncryptionContext:O": "ED14RK2GJ"
}
}
}

70. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Example policies: Baseline lockdown
{
"Effect": "Deny",
"Principal": {"AWS": "arn:aws:iam::152659312504:root"},
"Action": ["kms:Decrypt", "kms:GenerateDataKey"],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:EncryptionContext:O": "ED14RK2GJ"
}
}
}

71. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM to end users

72. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Example policies: Lockdown for a channel
{
"Effect": "Deny",
"Principal": {"AWS": "arn:aws:iam::152659312504:root"},
"Action": ["kms:Decrypt", "kms:GenerateDataKey"],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:EncryptionContext:C": "CD11VKXL3",
"kms:EncryptionContext:O": "ED14RK2GJ"
}
}
}

73. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Example policies: Lockdown org for a single month
{
"Effect": "Deny",
"Principal": {"AWS": "arn:aws:iam::152659312504:root"},
"Action": ["kms:Decrypt", "kms:GenerateDataKey"],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:EncryptionContext:O": "ED14RK2GJ"
},
"StringLike": {
"kms:EncryptionContext:H": "2019-06-*"
}
}
}

74. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM to end users

75. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Example policies: Combining channel and time
{
"Effect": "Deny",
"Principal": {"AWS": "arn:aws:iam::152659312504:root"},
"Action": ["kms:Decrypt", "kms:GenerateDataKey"],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:EncryptionContext:C": "CD11VKXL3",
"kms:EncryptionContext:O": "ED14RK2GJ"
},
"StringLike": {
"kms:EncryptionContext:H": "2019-06-25T06"
}
}
}

76. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

77. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
Decryption
Your AWS Account
Send Logs

78. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Example logs
{
"eventName": "Decrypt",
"requestParameters": {
"encryptionContext":{
"C": "CD11VKXL3",
"T": "TD2FCEBLN",
"H": "2018-10-24T21",
"O": "ED14RK2GJ"
}
},
// ...
}
{
"Action": "Decrypt",
"KeyScope": {
"C": "CD11VKXL3",
"H": "2018-10-24T21",
"O": "ED14RK2GJ",
"T": "TD2FCEBLN"
},
"Reason": "history"
}
AWS CloudTrail Amazon CloudWatch Logs

79. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Slack EKM
Most importantly, when you’re enrolled in
EKM, Slack remains Slack
You gain control of and visibility into how your
encryption keys are being used
And AWS KMS makes it fast and highly
available

80. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Joe Norman
Audrei Drummond