Overview of Encryption Data with AWS
Tags: AWS, Key Management, Encryption, Amazon Web Services, S3

2. When should data be encrypted?

Sensitive data must be protected in the following.

# While being transported, in transit

# While being stored, at rest

FIGURE1: “When should data be encrypted”, created by myself

Let’s have a look at more concretely.

Use cases to transport data, in transit

# Implement secure key and certificate management - AWS Certificate Manager

# Enforce encryption in transit - Security groups to allow HTTPS protocol to an Application Load Balancer or EC2 instance. - HTTPS with CloudFront - SSL/TLS with Amazon RDS, Amazon Redshift - IPsec VPN for securing point-to-point or network-to-network connections - s2n, a TLS library designed by AWS

sources: How do you protect your data in transit? — AWS Well-Architected Framework

Use cases to store data, at rest

The keys to encryption:

# Encryption method, where to be encrypted

# Key Management Infrastructure (KMI) - the storage component of the KMI - the management layer of the KMI

sources: Best Practices for Encrypting Data on AWS

AWS provides us three different models:

# Model A - You control the encryption method and the entire KMI

# Model B - You control the encryption method, AWS provides the KMI storage component, and you provide the KMI management layer

# Model C - AWS controls the encryption method and the entire KMI

sources: Best Practices for Encrypting Data on AWS

The differences between them is who manages three elements, customers or AWS.

Let’s have a check at the models one by one.

Model A: You control the encryption method and the entire KMI

# Amazon S3 - Client-side encryption with KMS managed keys (CSE-KMS),

Client-side encryption with customer-managed keys (CSE-C) -> Encript data before uploading to S3 -> Decript data when downloading it # Amazon EBS - capability to just only encrypt data volumes, not Amazon EBS boot volumes



- user-defined # AWS Storage Gateway

# Amazon RDS

Model B: You control the encryption method, AWS provides the KMI storage component, and you provide the KMI management layer

# The Differences between Model A and Model B is where keys are stored - Model A: in your on-premise infrastructures - Model B: in AWS CloudHSM

Model C: AWS controls the encryption method and the entire KMI

# Amazon S3 - SSE-S3 -> automatically encryption - SSE-KMS -> aws encryption for you - SSE-C

-> client-side encryption

# Amazon EBS

# Amazon RDS

# AWS Systems Manager Parameter Store

# Amazon Redshift

# Amazon EMR

# Amazon Glacier

# AWS Storage Gateway

Protecting Data Using Encryption

I’ll also give you the following figure so that I’m faced with questions about Encryption to Amazon S3 so many times.

FIGURE3: “Protecting Data Using Encryption”, created by myself

FIGURE4: “Cheat Sheet of Data Encryption”, created by myself

The points:

# There are two types of keys - Client Master Key(CMK) - Data Encryption Key(DEK)

# There are two location to be encrypted with CMK - Client-Side - Server-Side

# The location to be encrypted with DEK means that the differences between managed level - C < KMS < Amazon S3

Deep in dive into encryption

As I’ve studied encryption with AWS, I got the following questions.

# What is the differences between server-side and client-side encryption?

# Which services are encrypted by default?

What is the differences between server-side and client-side encryption?

The following material says.

The difference between server-side and client-side encryption is fairly simple. With server-side encryption, the encryption algorithm and process is run from the server-side — in this instance, within S3. Client-side encryption means that the encryption process is executed on the client first before the data is sent to S3 for storage.

source: AWS Certified Solutions Architect Official Study Guide

Which services are encrypted by default?

In transit:

# By Default - Amazon Glacier (with SSL) # By User-defined - AWS Storage Gateway (with HTTPS)

-> When transferred from on-premises to Amazon S3 - Amazon RDS (with SSL)

-> Between RDS and the other AWS service in VPC - Amazon ElastiCache for Redis

source: AWS認定資格試験テキスト AWS認定 ソリューションアーキテクト-アソシエイト

At rest:

# By Default - Amazon Glacier # By User-defined - Amazon EBS - Amazon S3 - AWS Storage Gateway (with KMS)

-> when stored in Amazon S3 - Amazon RDS

-> Storage where data is stored including read replica -> snapshot -> other related to RDS, like log - Amazon ElastiCache for Redis

-> Data stored in ElasticCache is encrypted

source: AWS認定資格試験テキスト AWS認定 ソリューションアーキテクト-アソシエイト

Summary

Let’s go over what I ’ve talked about so far.

# The first thing to protect your data is Data classification.

# When it should be encrypted, in transit is at rest.

# Use cases to transport data, in transit - Implement secure key and certificate management - Enforce encryption in transit

# Use cases to store data, at rest - Encryption method, where to be encrypted - Key Management Infrastructure (KMI)

# Amazon S3 Encryption Family - SSE-S3, SSE-KMS, SSE-C, CSE-KMS, CSE-C

Notes

The following article is so useful for me that I would like to share with you.

AWS Encrypting Data at Rest — Whitepaper — Certification

Please like this article and follow me:)