Question

A software distribution team needs to digitally sign firmware images so that customers and IoT devices can verify authenticity offline. The signing operation must occur inside AWS with the private key never leaving AWS, while the public key must be freely distributable to devices for verification without any AWS API calls. Which AWS KMS configuration meets these requirements?

Accepted Answer

Create an asymmetric KMS key with key usage SIGN_VERIFY, use the Sign API to produce signatures, and download the public key with GetPublicKey to embed in devices.

Answer

Create a symmetric KMS key and use GenerateMac to create an HMAC over each firmware image, distributing the shared key to devices.

Answer

Create an asymmetric KMS key with key usage ENCRYPT_DECRYPT, encrypt the firmware hash with the private key, and distribute the private key to devices.

Answer

Import external RSA key material into a symmetric KMS key and enable automatic annual rotation so devices can verify signatures using the rotated key.