4.1.1. Encryption at Rest (KMS, CloudHSM)
First Principle: Data encryption at rest secures sensitive information on persistent storage by transforming it into an unreadable format, preventing unauthorized access even if storage is compromised.
Encrypting data at rest is a critical security measure that protects your data when it is stored on physical devices (e.g., hard drives, SSDs). It ensures that if unauthorized parties gain access to the underlying storage, the data remains unreadable without the encryption key.
Key Concepts and Services for Encryption at Rest:
- Mechanism: Data is encrypted before it's written to disk and decrypted when it's read.
- AWS Key Management Service (KMS): A managed service that makes it easy to create and control encryption keys.
- Purpose: The primary service for managing encryption keys used across various AWS services.
- Benefits: Integrates seamlessly, manages key lifecycle (creation, rotation, deletion), and provides audit trails via AWS CloudTrail.
- Key Types: Customer Managed Keys (CMKs) (you create and manage, providing fine-grained control) and AWS-managed keys (AWS creates and manages on your behalf).
- AWS CloudHSM: A cloud-based hardware security module (HSM) that allows you to generate and use your own encryption keys on FIPS 140-2 Level 3 validated hardware.
- Purpose: For highly sensitive data and strict compliance requirements where you need exclusive control over cryptographic keys within a hardware security module.
- Integration with AWS Services: Many AWS services automatically encrypt data at rest or offer easy options to enable it using KMS (e.g., Amazon S3 encryption, Amazon EBS encryption, Amazon RDS encryption).
Scenario: You need to ensure all sensitive customer data stored in Amazon S3 buckets and attached to EC2 instances via EBS volumes is encrypted at rest to meet compliance requirements. You also have a very sensitive database that requires keys managed within a FIPS 140-2 Level 3 validated hardware module.
Reflection Question: How does implementing data encryption at rest using AWS KMS (for general encryption) and AWS CloudHSM (for high-assurance key management) fundamentally secure sensitive information on persistent storage, preventing unauthorized access even if storage is compromised?