Encryption Fundamentals

Encryption at rest protects data stored on disk, in databases, or in object storage. AWS offers multiple encryption options depending on the service.

SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts objects using AES-256 with keys managed entirely by S3. It is the simplest option with no configuration required. Each object is encrypted with a unique key, and the key itself is encrypted with a master key that rotates regularly.

SSE-KMS (Server-Side Encryption with KMS-Managed Keys) uses AWS KMS to manage encryption keys. You control the key policy, enabling key rotation, key disabling, and CloudTrail logging of key usage. For example, a healthcare company encrypting patient data uses SSE-KMS with a key policy allowing only the data team to decrypt, providing an audit trail of all data access.

SSE-C (Server-Side Encryption with Customer-Provided Keys) lets you supply your own encryption key with each PUT request. AWS does not store the key; you manage it entirely. Use this when you need full key control and cannot use AWS-managed keys.

Client-Side Encryption encrypts data before sending it to AWS. The application encrypts the data locally, uploads the ciphertext, and decrypts locally after download. This provides end-to-end encryption where AWS never sees plaintext data.

EBS Encryption encrypts EBS volumes using KMS keys. Encrypted volumes are automatically decrypted when attached to an instance and re-encrypted when snapshotted. Enable default EBS encryption at the account level to ensure all new volumes are encrypted.

RDS Encryption encrypts database storage, backups, and read replicas using KMS. Enabling encryption on an existing unencrypted database requires creating an encrypted snapshot and restoring from it.

Encryption in transit protects data moving between clients and AWS services, or between services within AWS. TLS (Transport Layer Security) is the standard protocol for encrypting data in transit.

HTTPS ensures all communication between clients and AWS services is encrypted. Most AWS services support HTTPS endpoints by default. For example, S3 bucket access via https://my-bucket.s3.amazonaws.com encrypts all data in transit.

AWS Certificate Manager (ACM) provisions, manages, and deploys SSL/TLS certificates at no cost. ACM certificates integrate with ALBs, CloudFront, API Gateway, and Elastic Load Balancing. For example, request a certificate for example.com, validate domain ownership via email or DNS, and attach the certificate to an ALB for HTTPS traffic.

ACM Private Certificate Authority issues private certificates for internal services that do not need public trust. Use private certificates for mTLS (mutual TLS) between microservices, where both client and server present certificates.

VPC Endpoints keep traffic within the AWS network. Without VPC endpoints, S3 and DynamoDB traffic traverses the public internet. With VPC gateway or interface endpoints, traffic stays within the AWS backbone, reducing latency and improving security.

Network-Level Encryption: For protocols that do not support TLS natively, use IPSec VPN or AWS PrivateLink to encrypt traffic. IPSec encrypts all IP traffic between your on-premises network and AWS VPC.

Envelope encryption is a two-layer encryption approach that balances security and performance. It is fundamental to how AWS KMS works.

In envelope encryption, data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a key encryption key (KEK) stored in KMS. Only the encrypted DEK is stored alongside the data; the plaintext DEK is discarded.

For example, when you upload an encrypted file to S3 with SSE-KMS, S3 requests a DEK from KMS. KMS encrypts the DEK with your KMS master key and returns the encrypted DEK. S3 encrypts the data with the plaintext DEK, stores the encrypted DEK alongside the ciphertext, and discards the plaintext DEK. To decrypt, S3 sends the encrypted DEK to KMS, which decrypts it and returns the plaintext DEK.

Envelope encryption is efficient because the same DEK can encrypt large amounts of data, and only one KMS call is needed per DEK operation instead of per data block.

Data Classification determines which encryption approach to use:

• Public data: No encryption required, but encryption in transit is still recommended
• Internal data: SSE-S3 or SSE-KMS with basic key policies
• Confidential data: SSE-KMS with restricted key policies and CloudTrail logging
• Highly confidential data: SSE-KMS with dedicated keys, client-side encryption, and strict access controls

A financial institution classifies customer PII as highly confidential, using client-side encryption before upload plus SSE-KMS for defense in depth.