6.2.3. Key Concepts Review: Data Protection & Encryption
First Principle: Comprehensive data protection fundamentally ensures the confidentiality, integrity, and availability of sensitive information throughout its lifecycle (at rest, in transit, during processing) to mitigate risks and meet compliance.
This review consolidates concepts for protecting data in AWS.
Core Concepts & AWS Services for Data Protection & Encryption:
- Encryption Fundamentals:
- Encryption at Rest: Secures data on persistent storage (AWS KMS, AWS CloudHSM).
- Encryption in Transit: Protects data moving across networks (TLS/SSL, AWS Certificate Manager (ACM)).
- AWS Key Management Service (KMS):
- Key Management: Customer Managed Keys (CMKs) vs. AWS-managed keys.
- Key Policies & Grants: Granular control over key usage.
- Integration: Seamless with hundreds of AWS services.
- Data Storage Security:
- Amazon S3 Security: Bucket Policies, ACLs, Public Access Block, encryption, versioning, Object Lock.
- EBS & RDS Encryption: Encryption for persistent block storage and relational databases.
- DynamoDB Encryption & Access Control: Default encryption, KMS integration, IAM policies.
- Sensitive Data Discovery: Amazon Macie for S3.
- Data Classification & Governance: Defining data sensitivity, managing data lifecycles.
Scenario: You need to secure highly sensitive customer data stored in Amazon S3 and an Amazon RDS database. This data is accessed by a web application over HTTPS. You must ensure it's encrypted at all times and that access is strictly controlled.
Reflection Question: How does comprehensive data protection, by ensuring confidentiality, integrity, and availability through robust encryption (at rest and in transit) and access controls (IAM, KMS), fundamentally mitigate risks and meet compliance requirements for your AWS workloads?