4.1.3. Data Encryption at Rest (KMS, S3 Encryption, EBS Encryption)

💡 First Principle: Data encryption at rest secures sensitive information on persistent storage by transforming it into an unreadable format, preventing unauthorized access even if storage is compromised.

Scenario: You need to ensure that all sensitive customer data stored in Amazon S3 buckets and attached to EC2 instances via EBS volumes is encrypted at rest to meet compliance requirements.

For SysOps Administrators, ensuring data is encrypted at rest is a critical security and compliance requirement. Encryption protects your data when it is stored on physical devices, such as hard drives or SSDs.

Key Services for Data Encryption at Rest:

• AWS Key Management Service (KMS): (A managed service that makes it easy to create and control encryption keys.) It's the central service for managing encryption keys used across various AWS services.
  • Benefits: Integrates seamlessly, manages key lifecycle (creation, rotation, deletion), and provides audit trails via AWS CloudTrail.
  • Key Types: AWS managed keys (AWS uses on your behalf) and Customer managed keys (CMKs) (you create and manage, providing more control).
• Amazon S3 Encryption: Offers various options for encrypting objects stored in S3 buckets:
  • SSE-S3: Encryption with S3-managed keys. Simplest to enable.
  • SSE-KMS: Encryption with AWS KMS customer master keys (CMKs). Provides more control and auditability.
  • SSE-C: Encryption with customer-provided keys.
• Amazon EBS Encryption: (Encrypts your EBS volumes and their snapshots.) You can enable encryption by default for all new EBS volumes in a Region. All data at rest, disk I/O, and snapshots are encrypted automatically.

⚠️ Common Pitfall: Not enabling default encryption for S3 buckets or EBS volumes, leaving newly created resources unencrypted.

Key Trade-Offs: Simplicity (SSE-S3) versus control and auditability (SSE-KMS).

Practical Implementation: Enabling default S3 bucket encryption with SSE-KMS via CLI:

aws s3api put-bucket-encryption \
    --bucket my-sensitive-data-bucket \
    --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "arn:aws:kms:us-east-1:123456789012:key/your-kms-key-id"}}]}'

Reflection Question: How would you implement data encryption at rest using AWS KMS (for managing keys) and configure S3 encryption (SSE-KMS) and EBS encryption to safeguard sensitive information on persistent storage?