Security · Topic 3 of 6

Encryption, KMS Keys and Certificates

Apply encryption at rest and in transit: client side versus server side, KMS Encrypt and GenerateDataKey, ACM and Private CA certificates, and SSH keys.

5 min

In a nutshell

SSE-S3 is the default and needs no work. SSE-KMS adds key level control and logging. SSE-C needs you to send the key each time.
Client side encryption is the choice when AWS must never see plaintext.
Encrypt and Decrypt handle up to 4 KB. Larger data uses GenerateDataKey and envelope encryption.

What it is

Encryption at rest protects stored data. Encryption in transit protects data moving over a network with TLS. A developer chooses where the encryption happens, which key is used and who is allowed to use that key.

AWS Key Management Service (AWS KMS) holds the keys. AWS Certificate Manager (ACM) and AWS Private CA handle certificates for TLS.

How it works

Server side or client side

With server-side encryption the service encrypts the data after it arrives. With client-side encryption your code encrypts before sending, so the service only ever sees ciphertext.

Option	Who encrypts	Key	Pick it when
SSE-S3	S3	Keys S3 manages	Default for new objects, no setup
SSE-KMS	S3	A KMS key you choose	You need key permissions and a CloudTrail record
SSE-C	S3	A key you send with every request (HTTPS only)	You hold the key but S3 does the work
Client side	Your code	Your key or a KMS key	AWS must never see plaintext

For SSE-KMS, set the x-amz-server-side-encryption header to aws:kms (the SDK parameter is ServerSideEncryption) and optionally name a key. The caller needs kms:GenerateDataKey to write and kms:Decrypt to read. An S3 Bucket Key reduces the number of KMS requests. Use the AWS Encryption SDK, or the encryption clients for S3 and DynamoDB, for client-side work.

Most storage services, including EBS, RDS, DynamoDB and SQS, encrypt at rest with a KMS key you can choose.

Using KMS keys in code

KMS keys never leave KMS in plaintext. Your code calls the API.

Encrypt and Decrypt handle at most 4 KB (4,096 bytes) of data. Use them for small secrets.
GenerateDataKey returns a plaintext data key and the same key encrypted under the KMS key. Encrypt your data locally with the plaintext key, discard it, and store the encrypted key beside the data. This is envelope encryption, and it is the answer for anything larger than 4 KB.
To read, call Decrypt on the encrypted data key, then decrypt the data locally.

An encryption context is a set of key and value pairs bound to the ciphertext. It is not secret, but the same context must be supplied to decrypt, and it appears in CloudTrail.

Access to a KMS key needs a key policy that allows it (directly, or by allowing IAM policies to control it). For cross account use, the key policy must allow the other account and that account's IAM policy must allow the KMS action.

Customer managed keys can have automatic rotation.

Certificates for encryption in transit

AWS Certificate Manager issues public TLS certificates and renews them automatically when DNS validation is used.

ACM certificates attach to integrated services: Elastic Load Balancing, CloudFront and API Gateway.
A certificate for CloudFront or an edge optimized API Gateway custom domain must be requested in US East (N. Virginia). A load balancer needs the certificate in its own Region.
By default ACM does not give you the private key. ACM can also issue exportable public certificates, which you request as exportable and which carry an extra charge. Use these when TLS ends on an EC2 instance or container.
AWS Private CA issues private certificates for internal services and devices. ACM can request them and manage renewal for integrated services.

Certificates and SSH keys for development

For a local test you can create a self signed certificate with openssl req -x509. Browsers will not trust it, so use it only on a development machine. For internal environments, issue a certificate from a private CA.

For SSH, ssh-keygen creates a key pair. You keep the private key and import only the public key into EC2 with import-key-pair, or let EC2 create the pair with create-key-pair, which returns the private key a single time. Protect the file (permission 400). EC2 Instance Connect pushes a temporary public key to an instance, so you do not manage a long lived key.

How the exam asks about this

"Encrypt a 1 MB payload with a KMS key" -> call GenerateDataKey and encrypt locally. Encrypt accepts only 4 KB.
"Auditors need to see who used the key and restrict it per application" -> SSE-KMS with a customer managed key.
"A site behind CloudFront needs HTTPS with a managed certificate" -> request an ACM certificate in us-east-1.

What to remember for the exam

SSE-S3 is the default and needs no work. SSE-KMS adds key level control and logging. SSE-C needs you to send the key each time.
Client side encryption is the choice when AWS must never see plaintext.
Encrypt and Decrypt handle up to 4 KB. Larger data uses GenerateDataKey and envelope encryption.
A caller using SSE-KMS needs permission on the KMS key as well as on the S3 object.
ACM certificates for CloudFront must live in us-east-1.
Private CA issues internal certificates. Self signed certificates are for development only.

Watch out

Disabling or scheduling deletion of a KMS key can make data unreadable. Disable first and watch for errors before deleting.

Common mistakes

Calling Encrypt on large files. The call fails above 4 KB. Switch to a data key.

Granting S3 access but not KMS access. With SSE-KMS the caller gets AccessDenied if the key policy or IAM policy does not allow the key.

Requesting the ACM certificate in the wrong Region. A CloudFront certificate in any Region other than us-east-1 cannot be selected.

Check yourself

Which KMS API do you call to encrypt a large file?
GenerateDataKey, then encrypt the file locally with the plaintext data key and store the encrypted data key with it.
Why can a user with s3:GetObject still fail to read an SSE-KMS object?
They also need kms:Decrypt on the key, allowed by the key policy or IAM policy.
Which service issues certificates for internal servers that the public cannot trust?
AWS Private CA.

Topic 3 of 6 in Security

Test yourself on Security

The full AWS DVA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.

Get Full Access Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.