2.1.3.1. Data Encryption at Rest: AWS KMS
2.1.3.1. Data Encryption at Rest: AWS KMS
💡 First Principle: Data encryption at rest secures data on persistent storage by transforming it into an unreadable format, preventing unauthorized access even if storage is compromised.
Encrypting data at rest is a critical security measure that protects your data when it is stored on physical devices, such as hard drives or SSDs. Even if unauthorized parties gain access to the underlying storage, the data remains unreadable without the encryption key.
AWS Key Management Service (KMS) is a managed service that makes it easy to create and control encryption keys used to encrypt your data. It integrates with almost all AWS services that store data, allowing for seamless encryption.
Key Aspects of KMS for Encryption at Rest:
- Managed Keys: KMS manages the security and durability of your encryption keys.
- Integration: Seamlessly encrypts data in S3, EBS, RDS, Lambda, EFS, etc.
- Control: You control who can use your keys and on which resources.
- Auditability: All key usage is logged in AWS CloudTrail.
S3 server-side encryption options:
| Option | Who controls the key | Choose when |
|---|---|---|
| SSE-S3 | S3 owns and manages the keys (AES-256); applied to new objects by default | Encryption at rest is enough — no key policy, per-key audit trail or revocation needed |
SSE-KMS with the AWS managed key (aws/s3) | KMS key created and rotated by AWS; its use is logged in CloudTrail, but you cannot edit its policy, disable it or delete it | KMS encryption with no key administration |
| SSE-KMS with a customer managed key | You own the key policy, grants and rotation, and can disable the key or schedule deletion — disabling it immediately blocks all decryption while the objects remain | You need control of the key lifecycle and access, auditable key use, or the ability to revoke access |
| SSE-C | You supply the key with every request; AWS does not store it | Keys must stay entirely outside AWS |
| Client-side encryption | Data is encrypted before upload | Data must never reach AWS in plaintext |
KMS mechanics:
- Envelope encryption: KMS generates a data key; the service encrypts the data locally with it, then stores the data key — encrypted under your KMS key — alongside the data. Bulk data never travels to KMS (the KMS
EncryptAPI accepts at most 4 KB). - Automatic rotation: Enable it on a customer managed key (yearly by default, period configurable). The key ID and ARN stay the same and older key material is kept for decryption, so nothing must be re-encrypted or reconfigured. AWS managed keys rotate yearly on their own.
- Aliases: A friendly name (e.g.
alias/app-key) that points to a key. Code that references the alias keeps working when you repoint the alias to a new key during manual rotation. - Grants: Temporary, narrowly scoped permission for a principal to use a key for specific operations without editing the key policy; retire or revoke the grant when done.
- AWS CloudHSM vs. KMS: KMS is a multi-tenant managed service (its HSMs are FIPS 140-3 Level 3 validated, but shared). CloudHSM provides dedicated, single-tenant HSMs (FIPS 140 Level 3 validated) under your exclusive control — chosen when regulation demands exclusive HSM access.
Encryption at rest in other services:
- EBS: Turn on EBS encryption by default (an account setting per Region) so every new volume is encrypted — with the AWS managed
aws/ebskey unless you choose a customer managed key. - EFS: Encryption at rest is chosen when the file system is created and cannot be turned on or off afterwards; to change it, create a new file system and copy the data.
- S3 baseline for confidential data: default encryption (SSE-S3 or SSE-KMS) for data at rest, plus S3 Block Public Access at the account or bucket level, which overrides any ACL or policy that would make data public.
Scenario: A company configures an S3 bucket to automatically encrypt new objects using AWS KMS, ensuring sensitive customer data remains protected against unauthorized access, even if storage is compromised.
Visual: Data Encryption at Rest with AWS KMS
⚠️ Common Pitfall: Not understanding the different types of S3 encryption (SSE-S3, SSE-KMS, SSE-C) and choosing the one that does not meet compliance needs for key management.
Key Trade-Offs:
- Security (KMS) vs. Performance Overhead: While KMS encryption adds a minor performance overhead and cost, it is generally negligible and essential for data security.
Reflection Question: Beyond network security, why is encrypting data at rest using a service like AWS KMS a crucial and fundamental step for a robust cloud security strategy, even if access is already tightly controlled?
