Design Secure Architectures · Topic 5 of 6
Encryption with KMS and Certificates
Choose encryption at rest and in transit on AWS: KMS keys, envelope encryption, S3 encryption options, CloudHSM and AWS Certificate Manager.
- 6 min
- Includes a diagram
- KMS uses envelope encryption: a data key encrypts the data, and a KMS key protects the data key.
- A customer managed key gives you control of the key policy, rotation and cross account sharing.
- SSE-S3 is the simplest choice. SSE-KMS adds control and audit. SSE-C means you provide the key.
What it is
Encryption turns data into unreadable text that only a holder of the right key can reverse. On AWS you protect data at rest (stored on disks, in buckets and in databases) and in transit (moving across a network).
The main service for keys is AWS Key Management Service (KMS). The main service for TLS certificates is AWS Certificate Manager (ACM). The exam asks which one to use, who controls the key, and how much work each choice needs.
How it works
KMS keys and envelope encryption
A KMS key never leaves KMS in plain form.
To encrypt large amounts of data, a service asks KMS for a data key, uses it to encrypt the data, and stores the encrypted copy of the data key beside the data. This is called envelope encryption. To read the data, the service asks KMS to decrypt the data key.
| Key type | Who manages it | Notes |
|---|---|---|
| AWS owned key | AWS | Invisible to you, used by default by some services |
| AWS managed key | AWS, in your account | Created per service (for example aws/s3). You see it but cannot change its policy |
| Customer managed key | You | You set the key policy, can enable rotation, disable it, and share it with other accounts |
Access to a key is controlled by the key policy, with IAM policies and grants adding to it. Use a customer managed key when you need control over who can use the key, an audit trail of its use in CloudTrail, or the ability to share it across accounts. Multi Region keys let you use the same key material in more than one Region, which helps with cross Region encryption and disaster recovery.
Encrypting S3 objects
| Option | Who holds the key | When to pick it |
|---|---|---|
| SSE-S3 | S3 manages the keys | Simplest choice, and the default for new objects |
| SSE-KMS | A KMS key | You need key level access control and an audit trail |
| SSE-C | You supply the key on each request | You must keep keys outside AWS |
| Client side | Your application encrypts before upload | AWS never sees the plain data |
SSE stands for server side encryption. With SSE-KMS, the caller also needs permission to use the KMS key, and a large number of requests can approach KMS request limits.
Other services
Amazon EBS volumes, snapshots, RDS databases, Amazon EFS file systems and DynamoDB tables all support encryption with KMS. Some of these you must turn on when you create the resource. A snapshot of an unencrypted RDS or EBS resource can be copied with encryption turned on, and a new encrypted resource is then created from the copy.
CloudHSM
AWS CloudHSM gives you dedicated hardware security modules that you control. Choose it when a rule says the customer alone must hold the keys in single tenant hardware. KMS is the easier choice for most cases.
Encryption in transit
TLS (Transport Layer Security) protects data between clients and services. AWS Certificate Manager issues and renews public certificates and deploys them to services that integrate with it, such as Elastic Load Balancing, CloudFront and API Gateway.
A standard public ACM certificate cannot be exported, so it works only with integrated services and not on a server you manage yourself.
ACM is Regional: a certificate for CloudFront must be requested in US East (N. Virginia), while one for a load balancer must be in the load balancer's Region. For an EC2 instance in an exam scenario, terminate TLS at a load balancer, or use a certificate from another authority.
You can also force encryption in transit in policy. A bucket policy with a condition on aws:SecureTransport set to false and an effect of Deny rejects plain HTTP requests.
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": ["arn:aws:s3:::example-bucket", "arn:aws:s3:::example-bucket/*"],
"Condition": {"Bool": {"aws:SecureTransport": "false"}}
}Rotation
Rotating a key reduces exposure over time. AWS managed keys rotate automatically on a yearly schedule, and you can enable automatic rotation on a customer managed key. Rotation of KMS key material does not require you to re-encrypt existing data.
When the question asks for the least effort to meet an encryption requirement, choose the default managed option (SSE-S3 or an AWS managed key). Move to a customer managed key only when control, sharing or audit is stated.
What to remember for the exam
- KMS uses envelope encryption: a data key encrypts the data, and a KMS key protects the data key.
- A customer managed key gives you control of the key policy, rotation and cross account sharing.
- SSE-S3 is the simplest choice. SSE-KMS adds control and audit. SSE-C means you provide the key.
- Many services (EBS, RDS, EFS, DynamoDB) integrate with KMS, and encryption is often chosen when creating the resource.
- CloudHSM is for dedicated, customer controlled hardware keys.
- ACM manages public TLS certificates for load balancers, CloudFront and API Gateway, and renews them automatically. A CloudFront certificate must be in us-east-1.
- Use the
aws:SecureTransportcondition to require HTTPS to S3. - To encrypt an existing unencrypted database or volume, copy a snapshot with encryption and restore from the copy.
Common mistakes
Assuming a key can be shared by default. An AWS managed key cannot be used from another account. Cross account encryption needs a customer managed key whose policy allows the other account.
Trying to install an ACM certificate on EC2 by hand. A standard public ACM certificate cannot be exported. Place a load balancer or CloudFront in front.
Forgetting the key permission. With SSE-KMS, a user can have S3 access and still fail to read an object if the key policy does not allow them.
Thinking encryption at rest protects against all access. If a role has permission to decrypt, it reads the plain data. Use IAM and key policies as well.
Deleting a KMS key makes all data encrypted with it unrecoverable. KMS enforces a waiting period before deletion, so disable a key first if you are unsure.
Check yourself
What is envelope encryption?
A data key encrypts the data, and a KMS key encrypts that data key, so the large data never goes to KMS.
Which S3 encryption option gives key level access control and a CloudTrail record of key use?
SSE-KMS.
How do you encrypt an existing unencrypted RDS database?
Take a snapshot, copy it with encryption enabled, and restore a new database from the encrypted copy.
Topic 5 of 6 in Design Secure Architectures
Test yourself on Design Secure Architectures
The full AWS SAA-C03 question bank has 823 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.