Storage and Database Encryption

What it is

Encryption at rest protects stored data if disks, snapshots or backups are accessed by someone who should not have them. AWS services handle the mechanics, and your job is to choose the key model, enforce it, and avoid the special cases that break it.

The exam asks which encryption option fits a requirement for control, audit, cost or compliance.

How it works

Amazon S3

All new objects are encrypted at rest with SSE-S3 by default. For SSE-KMS, set the bucket default encryption to a KMS key, and use an S3 Bucket Key to cut the number of calls to KMS, which lowers cost and avoids request limits on busy buckets.

To enforce a particular method, write a bucket policy that denies uploads without it.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "RequireKmsEncryption",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*",
    "Condition": { "StringNotEquals": { "s3:x-amz-server-side-encryption": "aws:kms" } }
  }]
}

Requests that omit the header are also denied by this policy, so clients must send it. Principals that read SSE-KMS objects need kms:Decrypt on the key, and writers need kms:GenerateDataKey. A missing KMS permission appears as AccessDenied on the S3 call.

Protecting S3 data from change

Compliance mode cannot be shortened or removed by anyone, including the root user, until retention ends. Governance mode lets users with special permission override it.

Amazon EBS

Enable EBS encryption by default per Region so that every new volume is encrypted. Snapshots of encrypted volumes are encrypted, and volumes created from them are too. Encryption affects performance only slightly, and covers data at rest, data moving between the instance and the volume, and snapshots.

An existing unencrypted volume cannot be encrypted in place. Snapshot it, copy the snapshot with encryption enabled, and create a new volume from the copy.

Amazon RDS and Aurora

Encryption is chosen when you create the DB instance or cluster, and covers storage, automated backups, snapshots and read replicas. You cannot turn it on for an existing unencrypted instance directly. The fix is to take a snapshot, copy it with encryption, and restore a new instance from the copy.

# AWS CLI: copy an unencrypted RDS snapshot as an encrypted one
aws rds copy-db-snapshot \
  --source-db-snapshot-identifier mydb-snap \
  --target-db-snapshot-identifier mydb-snap-enc \
  --kms-key-id alias/app-data

Read replicas of an encrypted instance are encrypted. To share an encrypted snapshot with another account, it must use a customer managed key that the other account can use. For database engines that offer Transparent Data Encryption (TDE), such as Oracle and SQL Server, TDE is an additional database level option.

Other services

• DynamoDB. All tables are encrypted at rest. You choose an AWS owned key, an AWS managed key or a customer managed key.
• Amazon EFS. Choose encryption at creation. It cannot be turned on later for an existing file system, so create a new one and copy the data.
• Amazon Redshift. Encrypt clusters with a KMS key.
• AWS Backup. Recovery points are stored in a vault that is encrypted with a KMS key, and they can be copied across accounts and Regions.
• Amazon SQS and SNS. Use server side encryption with KMS for the queues and topics.

Choosing a key model