Security and Compliance · Topic 4 of 5

Encryption, KMS and Secrets

Protect data at rest and in transit with KMS keys, EBS, RDS and S3 encryption, ACM certificates, and choose between Secrets Manager and Parameter Store.

5 min

In a nutshell

KMS key types are AWS owned, AWS managed and customer managed, and only customer managed keys give full control.
The key policy is the primary control for a KMS key.
Envelope encryption uses a data key protected by the KMS key.

What it is

Encryption protects data if storage or traffic is exposed. Data at rest is encrypted where it is stored, and data in transit is encrypted while it moves over a network.

AWS Key Management Service (KMS) creates and controls the encryption keys that most AWS services use. Secrets such as passwords and API keys belong in a secrets service, not in code or user data.

How it works

KMS keys

Key type	Who manages it	Notes
AWS owned key	AWS	Used inside services, not visible in your account
AWS managed key	AWS, in your account	Named like `aws/s3`, you cannot edit its policy and it rotates automatically
Customer managed key	You	You control the key policy, rotation, and sharing

Choose a customer managed key when you need control: cross account sharing, custom rotation, disabling, or an audit trail of your own key. Every use of a key is logged in CloudTrail.

Access to a KMS key is controlled mainly by its key policy. IAM policies can only grant key access if the key policy allows IAM to do so. For cross account use, the key policy must allow the other account, and that account's identities need IAM permission as well.

Services use envelope encryption. KMS creates a data key, the service encrypts the data with it, and the data key is stored encrypted under the KMS key. This means large data is not sent to KMS.

Key rotation can be turned on for customer managed symmetric keys.

Deleting a key has a mandatory waiting period (between 7 and 30 days), during which you can cancel. If you only want to stop use, disable the key. For fully dedicated hardware, AWS CloudHSM gives you single tenant HSMs (hardware security modules) that you control.

Encrypting storage

Service	What to know
EBS	Encrypted with KMS. You can turn on encryption by default for a Region. An existing unencrypted volume cannot be encrypted in place
RDS	Chosen when the database is created. To encrypt an existing database, copy a snapshot with encryption and restore from it
S3	New objects are encrypted by default with server side encryption using S3 managed keys (SSE-S3). SSE-KMS uses a KMS key for control and audit
EFS	Chosen when the file system is created
DynamoDB	Always encrypted at rest

# AWS CLI: encrypt all new EBS volumes in this Region by default
aws ec2 enable-ebs-encryption-by-default

# Encrypt an existing volume: snapshot, then copy with encryption
aws ec2 copy-snapshot --source-region us-east-1 \
  --source-snapshot-id snap-0123456789abcdef0 \
  --encrypted --kms-key-id alias/data-key

A bucket policy can require encryption by denying uploads that lack the right header, or by denying non TLS requests with the aws:SecureTransport condition.

Encryption in transit

Use TLS (Transport Layer Security). AWS Certificate Manager (ACM) issues and renews public certificates for use on load balancers, CloudFront and API Gateway at no extra cost for the certificate.

Certificates for CloudFront must be requested in US East (N. Virginia). ACM public certificates cannot be installed directly on an EC2 instance.

For databases, require TLS connections with the engine's setting. For private connectivity between a data center and AWS, use a VPN connection.

Secrets Manager and Parameter Store

Feature	Secrets Manager	Parameter Store
Purpose	Secrets that need lifecycle management	Configuration and simple secrets
Automatic rotation	Yes, with built in support for RDS and others	No built in rotation
Encryption	Always, through KMS	SecureString type, through KMS
Cost	Charged per secret	Standard tier has no charge
Cross account sharing	Resource policy	More limited

# AWS CLI: read a secret at run time
aws secretsmanager get-secret-value --secret-id prod/db/credentials

The application role needs permission to read the secret and to use the KMS key that protects it. Applications should fetch secrets at run time, never bake them into AMIs, code or user data.

Exam tip

"Automatically rotate database credentials" points to Secrets Manager. "Cheap configuration values and basic secrets" points to Parameter Store.

What to remember for the exam

KMS key types are AWS owned, AWS managed and customer managed, and only customer managed keys give full control.
The key policy is the primary control for a KMS key.
Envelope encryption uses a data key protected by the KMS key.
Key deletion waits 7 to 30 days, and disabling is the safer way to stop use.
An unencrypted EBS volume or RDS database cannot be encrypted in place, so use a snapshot copy.
S3 encrypts new objects by default, and SSE-KMS adds control and audit.
ACM issues public certificates for supported services, with automatic renewal when validation stays in place.
CloudFront certificates from ACM must be in US East (N. Virginia).
Secrets Manager rotates secrets, and Parameter Store does not.

Common mistakes

Sharing an encrypted snapshot without the key. The other account cannot use it without access to the customer managed key.

Using an AWS managed key for cross account sharing. You cannot edit its policy, so use a customer managed key.

Deleting a key to stop use. Data encrypted under it becomes unreadable after the waiting period. Disable it first.

Storing credentials in user data. They can be read from instance metadata. Use a secrets service.

Forgetting KMS permissions. A role may have S3 access yet fail on an SSE-KMS object because it cannot use the key.

Watch out

A deleted KMS key cannot be recovered after the waiting period, and everything encrypted only under it is lost.

Check yourself

Work through these.

How do you encrypt an existing unencrypted RDS database?
Take a snapshot, copy it with encryption enabled, and restore a new database from the encrypted copy.
Which service rotates database passwords automatically?
AWS Secrets Manager.
What is the safer alternative to deleting a KMS key?
Disable the key, since deletion is permanent after the waiting period.

Topic 4 of 5 in Security and Compliance

Test yourself on Security and Compliance

The full AWS SOA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.