3.4.2.7. Encrypting Data in Transit & At Rest (KMS, CloudHSM, ACM)

3.4.2.7. Encrypting Data in Transit & At Rest (KMS, CloudHSM, ACM)

Encryption is non-negotiable for compliance frameworks (SOC 2, HIPAA, PCI DSS). AWS provides encryption at every layer.

At-rest encryption across services:

KMS vs. CloudHSM:

• KMS: Multi-tenant, managed. Best for most use cases. FIPS 140-2 Level 2.
• CloudHSM: Single-tenant hardware. Required for FIPS 140-2 Level 3 compliance. You manage the HSM cluster.

In-transit encryption:

• ALB/NLB → TLS termination with ACM certificates
• Service-to-service → TLS (SDK default), VPC endpoints (private network)
• Database connections → RDS/Aurora support TLS; enforce with require_ssl parameter

# Enforce TLS on RDS connections
aws rds modify-db-parameter-group \
  --db-parameter-group-name prod-params \
  --parameters "ParameterName=rds.force_ssl,ParameterValue=1,ApplyMethod=pending-reboot"

Exam Trap: RDS encryption must be enabled at creation time — you cannot encrypt an existing unencrypted RDS instance. To encrypt an existing instance: create a snapshot → copy the snapshot with encryption enabled → restore from the encrypted snapshot. If the exam describes migrating an unencrypted database to encrypted, this is the required workflow.