Security, Compliance, and Governance · Topic 4 of 8
Encryption, Certificates, HSMs and Post-Quantum
KMS customer managed keys and rotation, ACM and Private CA for TLS, CloudHSM for sole HSM control, and ML-DSA and ML-KEM for post-quantum plans.
- 6 min
- Automatic rotation works only for symmetric KMS keys with KMS-generated material; the key ID stays the same.
- AWS managed keys rotate every year and you cannot change that.
- ACM public certificates renew automatically; CloudFront certificates must be in US East (N. Virginia).
What it is
Encryption questions at professional level are rarely about whether to encrypt. They ask who controls the key, how it rotates, where the key material lives, and how certificates renew without manual work.
A new theme is post-quantum readiness. AWS now offers lattice-based algorithms standardized by NIST, and the exam expects you to know where they fit.
How it works
Customer managed keys in AWS KMS
| Key type | Who controls the policy | Rotation |
|---|---|---|
| AWS owned key | AWS service | Managed by the service |
| AWS managed key | AWS, per service per account | Every year, cannot be changed |
| Customer managed key | You | Optional automatic, on demand, or manual |
Choose a customer managed key when you need your own key policy, cross-account use, grants, audit of every use in CloudTrail, or the ability to disable the key. Cross-account use needs both the key policy and the caller's IAM policy to allow it.
Automatic rotation works on symmetric encryption keys whose material KMS generated. The default period is 365 days and you can set a custom rotation period. KMS keeps every old version of key material, so old ciphertext still decrypts and the key ID and ARN never change.
On-demand rotation also works for symmetric keys with imported key material. Asymmetric keys, HMAC keys and keys in custom key stores do not support automatic rotation; you rotate them manually by creating a new key and moving an alias.
Rotation does not re-encrypt your data or rotate data keys already generated.
Certificates with ACM and AWS Private CA
AWS Certificate Manager (ACM) issues public TLS certificates and renews them automatically for DNS-validated domains. You deploy them on integrated services: Elastic Load Balancing, CloudFront and API Gateway.
A certificate for CloudFront must be in the US East (N. Virginia) Region.
AWS Private CA runs a private certificate authority for internal names, service to service TLS and mutual TLS. ACM can issue and renew private certificates from it, and the same CA can be the trust anchor for IAM Roles Anywhere.
To use TLS 1.3, pick a TLS 1.3 security policy on the ALB or NLB listener and the matching CloudFront security policy. To enforce encryption in transit for S3, deny requests where aws:SecureTransport is false.
Dedicated HSMs with AWS CloudHSM
KMS already stores keys in HSMs that AWS manages. CloudHSM is different: single-tenant HSMs in your VPC, where you create and manage the crypto users and AWS cannot see your keys.
| Requirement | Choose |
|---|---|
| Managed keys integrated with AWS services, least effort | AWS KMS |
| Exclusive, single-tenant control of the HSM | AWS CloudHSM |
| Applications that use PKCS #11, JCE, CNG or KSP | AWS CloudHSM |
| KMS integration, but key material in your own CloudHSM cluster | KMS custom key store backed by CloudHSM |
| Key material must stay outside AWS | KMS external key store |
CloudHSM clusters in FIPS mode use FIPS validated HSMs. Run at least two HSMs in different Availability Zones, because a single HSM is a single point of failure. If you lose the crypto user credentials, AWS cannot recover the keys.
Post-quantum cryptography
A large quantum computer would break today's public-key algorithms (RSA and elliptic curve). Symmetric AES-256, which KMS uses for its default keys, is considered quantum resistant.
The urgent risk is "harvest now, decrypt later": an attacker records encrypted traffic today and decrypts it once quantum computers exist. Long-lived signatures, such as on firmware or legal documents, are the second risk.
| Need | AWS option |
|---|---|
| Quantum-resistant digital signatures | KMS asymmetric keys with ML-DSA key specs (ML_DSA_44, ML_DSA_65, ML_DSA_87) |
| Quantum-resistant key establishment | KMS ML-KEM key specs (ML_KEM_512, ML_KEM_768, ML_KEM_1024) with Encapsulate and Decapsulate |
| Protect traffic to AWS service endpoints | Hybrid post-quantum TLS (classical key exchange plus ML-KEM) to KMS, ACM and Secrets Manager, enabled in supported SDKs |
| Protect traffic to your own load balancers | ALB or NLB security policies with PQ in the name |
A good strategy has four steps: inventory where public-key cryptography is used, rank data by how long it must stay secret, adopt hybrid post-quantum TLS first for long-lived sensitive traffic, then move signing to ML-DSA. Design for crypto agility, so algorithms can change without rewriting applications.
How the exam asks about this
- "A regulator requires that the company has sole control of single-tenant HSMs and that AWS cannot access the keys." -> AWS CloudHSM, optionally as a KMS custom key store for service integration.
- "Keys must rotate yearly with no application changes and no re-encryption project." -> KMS customer managed key with automatic rotation enabled.
- "Traffic captured today must not be decryptable by a future quantum computer." -> Hybrid post-quantum TLS with ML-KEM on endpoints and clients.
What to remember for the exam
- Automatic rotation works only for symmetric KMS keys with KMS-generated material; the key ID stays the same.
- AWS managed keys rotate every year and you cannot change that.
- ACM public certificates renew automatically; CloudFront certificates must be in US East (N. Virginia).
- CloudHSM means single-tenant HSMs and customer-managed crypto users; KMS is the low-overhead default.
- ML-DSA is for signatures; ML-KEM is for key establishment. AES-256 is already quantum resistant.
- Use custom key stores (CloudHSM) or external key stores when key material location is regulated.
Do not pick CloudHSM just because a question says "FIPS validated HSM". KMS also uses FIPS validated HSMs. CloudHSM is the answer when the requirement is single-tenant hardware, exclusive control, or standard HSM APIs.
Common mistakes
Expecting rotation to re-encrypt data. Rotation adds new key material for new encryption. Existing data and data keys stay as they were.
Enabling automatic rotation on asymmetric keys. It is not supported. Asymmetric, HMAC and custom key store keys rotate manually with a new key and an alias change.
Treating post-quantum as replacing AES. The change is in public-key algorithms used for key exchange and signatures. Symmetric AES-256 encryption at rest stays.
Check yourself
What happens to old ciphertext after a KMS key rotates?
It still decrypts, because KMS keeps all earlier key material and picks the version that encrypted the data.
When is AWS CloudHSM the right choice over AWS KMS?
When the requirement is single-tenant HSMs under your exclusive control, or applications that need standard APIs such as PKCS #11 or JCE.
Which algorithm addresses "harvest now, decrypt later" for data in transit?
ML-KEM, used in hybrid post-quantum TLS key exchange.
Topic 4 of 8 in Security, Compliance, and Governance
Test yourself on Security, Compliance, and Governance
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.