Choose who can unlock your data — KMS and S3

Your goal

Encrypt a practice message with a key and decrypt the resulting bytes.

Why this matters

Encryption should produce data that the intended key can recover. You will encrypt a message and check a real decrypt response. The keys and data remain inside the practice emulator.

Words you will use

Encryption turns readable data into protected data. A key helps encrypt or decrypt it. KMS manages encryption keys and rules for their use.

How to proceed

Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.

1. Create an encryption key

Create a symmetric KMS key in the emulator. The key ID identifies it for later requests. This is practice cryptography in a local emulator, not a production key-management service.

2. Encrypt your message

Type a harmless message and send its bytes to Encrypt. Save the returned ciphertext on the server. Ciphertext is different from a key ID or an encoded copy of the original text.

Practice message: Type a short message that you can recognize in the API result. Suggested practice value: Hello from my lab.

3. Decrypt and compare

Send the ciphertext to Decrypt using the same key. Compare the returned plaintext with your input. This lab actually checks an encryption/decryption round trip through the API.

Practice, then check your understanding

Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.

Read the official AWS documentation for service behavior and production details.