Data Security and Governance · Topic 4 of 7
Encryption with KMS
Encrypt data at rest and in transit on AWS with KMS keys, S3 server side encryption options, key policies, rotation, bucket keys, Redshift and TLS.
- 5 min
- Includes a diagram
- KMS keys: AWS owned, AWS managed, customer managed. Customer managed gives the most control.
- Envelope encryption uses a data key wrapped by a KMS key.
- The key policy is the main control. IAM alone is not enough without it.
What it is
Encryption turns readable data into ciphertext that only a holder of the right key can read. Data should be encrypted at rest, in storage, and in transit, across the network.
On AWS the key service is AWS Key Management Service (KMS). Most data services integrate with it, so you choose a key and the service handles the cryptography.
How it works
Keys in KMS
KMS holds keys and does the cryptographic operations. Key types you should know:
| Key type | Who manages it | Notes |
|---|---|---|
| AWS owned key | AWS | Used by default in some services, not visible in your account |
| AWS managed key | AWS, in your account | Created per service, rotated automatically, policy cannot be edited |
| Customer managed key | You | You set the key policy, rotation, and can disable or schedule deletion |
Customer managed keys give the most control, because you set the key policy and the rotation. Key use is logged in CloudTrail, and customer managed keys are the usual answer when a requirement mentions control of rotation, access or separation of duties.
Envelope encryption
KMS does not encrypt large data directly. A service asks KMS for a data key, encrypts the data with it, and stores the data key in encrypted form next to the data.
To read, the service sends the encrypted data key to KMS, which decrypts it if the caller is allowed. This is called envelope encryption.
Key policies and grants
Every KMS key has a key policy, and it is the main way to control access. A caller needs permission in the key policy (directly or by delegating to IAM) to use the key. IAM policies can then allow actions such as kms:Decrypt and kms:GenerateDataKey.
For cross account use, the key policy must allow the other account, and that account's role must allow the KMS actions as well. Multi Region keys let you use the same key material in more than one Region, which helps with cross Region replication and disaster recovery.
Amazon S3 encryption
| Option | Key management |
|---|---|
| SSE-S3 | S3 manages the keys. This is applied by default to new objects |
| SSE-KMS | You use a KMS key and get CloudTrail logs of key use and key level control |
| DSSE-KMS | Two layers of server side encryption with KMS |
| SSE-C | You supply the key with each request |
| Client side | You encrypt before uploading |
SSE-KMS makes many requests to KMS, which can cost money and hit request limits on busy buckets. An S3 Bucket Key reduces those calls. You can require encryption with a bucket policy or default bucket encryption.
Other services
- Amazon Redshift: encrypts clusters and snapshots with KMS (or a hardware security module). Encryption can be turned on for an existing cluster.
- DynamoDB: all tables are encrypted at rest, using an AWS owned key, an AWS managed key or a customer managed key.
- RDS and Aurora: encryption is chosen at creation, and snapshots follow the source.
- EBS volumes for EMR: support encryption, and EMR security configurations can encrypt data at rest and in transit.
- Kinesis Data Streams and Firehose: server side encryption with KMS.
- Glue: security configurations encrypt job output, bookmarks and logs.
Encryption in transit
Use TLS (Transport Layer Security) for every connection. For S3, a bucket policy condition aws:SecureTransport set to false with a deny rejects plain HTTP.
For Redshift, set require_ssl in the parameter group. MSK supports TLS between clients and brokers, and between brokers. Client side encryption is useful when data must stay unreadable even to the service.
Rotation, disabling and deletion
Customer managed symmetric keys can rotate automatically, and old key material remains available so existing data can still be decrypted.
Rotation does not require re encrypting data. Deleting a key has a mandatory waiting period (7 to 30 days), because deleting it makes data unreadable. You can disable a key to block use.
Compliance and certificates
AWS Certificate Manager (ACM) issues and renews TLS certificates for endpoints such as load balancers. Use AWS CloudHSM when a rule demands dedicated hardware security modules you control.
What to remember for the exam
- KMS keys: AWS owned, AWS managed, customer managed. Customer managed gives the most control.
- Envelope encryption uses a data key wrapped by a KMS key.
- The key policy is the main control. IAM alone is not enough without it.
- SSE-S3 is the default for new S3 objects. SSE-KMS adds audit and control.
- S3 Bucket Keys cut KMS request costs.
- Deny non TLS requests with
aws:SecureTransportin a bucket policy. - Key deletion has a waiting period of 7 to 30 days.
- Cross account decryption needs both the key policy and the caller's IAM permission.
"Audit who decrypted data and control rotation" means SSE-KMS with a customer managed key.
Common mistakes
Forgetting the key policy. A role with S3 access can still fail if it cannot use the KMS key.
Assuming rotation re encrypts data. Old data stays encrypted under the older key material, which KMS keeps available.
Using SSE-C for convenience. You must supply the key on every request and lose it if it is mislaid.
Ignoring in transit. Encryption at rest does not protect data moving over HTTP.
Scheduling a KMS key for deletion makes any data encrypted under it unrecoverable once the waiting period ends, so disable the key first and check for use.
Check yourself
Which S3 encryption option gives CloudTrail logs of each key use?
SSE-KMS.
What reduces KMS request costs on a busy SSE-KMS bucket?
An S3 Bucket Key.
How do you reject unencrypted HTTP requests to a bucket?
Add a bucket policy deny on requests where
aws:SecureTransportis false.
Topic 4 of 7 in Data Security and Governance
Test yourself on Data Security and Governance
The full AWS DEA-C01 question bank has 845 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.