Encryption and Key Management

A key element of AWS security is the ability to be able to encrypt sensitive and confidential data across different services, helping to ensure it's protected from those who should not have access to the plaintext data. Understanding different encryption methods within these services allows you to maintain the confidentiality of the data.

This chapter will focus on a number of key services and the encryption options that are available to use. As a part of this, the Key Management Service, known as KMS, will also be discussed in detail. This service allows you to control and manage encryption keys which can either be imported from your own KMS system or those that are generated by AWS itself. The KMS service is also integrated with many other AWS services.

In this chapter, we will cover the following topics:

An overview of encryption
EBS encryption...

Technical requirements

To gain the most from this chapter, you should have a basic understanding of the following services. Since this chapter covers encryption, the following AWS services will be mentioned throughout:

Elastic Block Store (EBS)
Amazon Simple Storage Service (S3)
Relational Database Service (RDS)
IAM policies

An overview of encryption

Before we get deeper into the different techniques and methods used by AWS to encrypt your data, an overview and an understanding of the different key cryptography mechanisms is needed.

Any data that has not been encrypted is known as plaintext, which simply means that the data is in a readable format without the need for any mathematical intervention to alter the data before it can be read. When data is in a state of plaintext, anyone who has read access to the data can access it and view the information contained within it. As long as this data is not sensitive or contains confidential information, then this unencrypted data can remain unencrypted. However, if the data IS sensitive, such as containing customer details and information, then there will be a requirement to protect and secure this data as a priority.

Sensitive data must be encrypted, since...

EBS encryption

The Elastic Block Store (EBS) service is AWS's answer to block-level storage and is used as persistent, reliable, and highly available storage that is attached to your EC2 instances. EBS offers built-in encryption options that allow you to easily implement encryption for data stored on these volumes. Due to the importance and criticality of data protection, EBS supports encryption across all EBS volumes types and ensures that there is no negative performance impact relating to your IOPS of the volume. Do be aware, however, that although encryption is possible across all volume types, it is not available across all instance types within those volume types.

For an up-to-date list of available instances, please go to the following link: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#EBSEncryption_supported_instances.

One key point in understanding...

Amazon S3 encryption

Amazon S3 provides an object-level storage solution, allowing you to save objects up to 5 terabytes in size. Being a storage solution, and one of the most commonly used storage services within AWS, S3 provides a variety of encryption mechanisms to suit different requirements and compliance concerns.

There are five different encryption options available to encrypt your S3 objects, as follows:

Server-side encryption with S3 managed keys (SSE-S3)
Server-side encryption with KMS managed keys (SSE-KMS)
Server-side encryption with customer-managed keys (SSE-C)
Client-side encryption with KMS managed keys (CSE-KMS)
Client-side encryption with customer-managed keys (CSE-C)

The difference between server-side and client-side encryption is fairly simple. With server-side encryption, the encryption algorithm and process is run from the server-side—in this instance...

RDS encryption

When using Amazon RDS, there may be times when the data held within your database needs to encrypted due to its sensitivity. When RDS encryption is enabled, which uses the AES-256 algorithm, it ensures that all underlying storage that's used is encrypted, along with all associated read-replicas, automated backups, and snapshots, following the enablement without any further configuration needed.

RDS encryption is offered at rest and is easily enabled by using the following database engines:

Amazon Aurora
MySQL
MariaDB
PostgreSQL
Oracle
Microsoft SQL Server

How to enable encryption

As an example, to configure encryption for Amazon Aurora, you can perform the following steps:

Select Amazon RDS from the...

Key Management Service (KMS)

Throughout this chapter, I have mentioned the Key Management Service a number of times, mainly in relation to other services using it such as S3 and RDS, as well as many other AWS services that require encryption to be performed.

We already know that KMS uses symmetric cryptography, and this was evident when we looked at the S3 encryption mechanisms, since we saw that the very same key was used to decrypt the data that was used to encrypt the data. This is essentially symmetric cryptography. In this section, I will dive a little deeper into KMS to allow you to gain more of an understanding about the service itself.

So, what is KMS?

KMS is a central repository for storing encryption keys (customer...

Summary

Encryption is a necessity when storing data within the cloud—there is a level of trust given to AWS any time a customer stores data on their infrastructure. However, should this data be sensitive and confidential, additional measures should be put in place by us as the customer to ensure that the data is protected. This is often a requirement of many compliance regulations and governance controls that organizations are required to meet. AWS is aware of the importance of this factor and so has provided numerous methods and mechanisms of encryption to allow you to do just that.

Many AWS services come with some form of encryption, and in this chapter, we covered some of the most common services which are referenced within the certification. These services interact with the KMS, and so gaining a good understanding of this service and the different services and components...