Data Management and Security: Classification, Encryption, and Access Control

This study guide focuses on the critical pillars of data protection within the AWS ecosystem, specifically tailored for the DevOps Engineer Professional (DOP-C02) exam. We explore how to automate data discovery, manage encryption lifecycles, and enforce robust access controls.

Learning Objectives

After studying this guide, you should be able to:

• Automate the discovery and classification of sensitive data using Amazon Macie.
• Differentiate between AWS KMS key types (Customer Managed, AWS Managed, and AWS Owned).
• Implement envelope encryption and explain the relationship between KMS keys and data keys.
• Configure automated key rotation and secret rotation for machine identities.
• Design access control strategies combining IAM policies, KMS key policies, and Secrets Manager.

Key Terms & Glossary

• Envelope Encryption: The practice of encrypting plaintext data with a data key, and then encrypting that data key under another key (KMS Key).
• KMS Key: A logical representation of a master key, containing the key ID, creation date, description, and key material.
• Amazon Macie: A fully managed data security and data privacy service that uses machine learning to discover and protect sensitive data in S3.
• AWS Secrets Manager: A service used to manage, rotate, and retrieve database credentials, API keys, and other secrets.
• CMK (Customer Master Key): The older term for KMS keys. Note that modern documentation uses "KMS Key."

The "Big Idea"

Data management in AWS is a defense-in-depth strategy. It isn't just about "turning on encryption." It is a lifecycle that begins with Classification (knowing what data is sensitive), followed by Protection (encrypting at rest and in transit), and finalized by Governance (auditing via CloudTrail and controlling access via IAM/KMS policies). Automation is the glue that ensures these controls remain consistent across multi-account and multi-region environments.

Formula / Concept Box

Hierarchical Outline

1. Data Discovery & Classification
   • Amazon Macie: Scans S3 buckets for PII (Personally Identifiable Information).
   • Automated Remediation: Triggering Lambda functions when Macie finds unencrypted sensitive data.
2. Encryption at Rest
   • AWS KMS: Managed service for creating and controlling keys.
   • CloudHSM: Single-tenant hardware security module for strict compliance (FIPS 140-2 Level 3).
3. Encryption in Transit
   • AWS Certificate Manager (ACM): Provisioning and renewing SSL/TLS certificates.
   • Integration: ALB, CloudFront, and API Gateway integration.
4. Access Control & Auditing
   • Key Policies: Resource-based policies that define who can use/manage a KMS key.
   • IAM Policies: User-based permissions.
   • AWS CloudTrail: Logs every API call made to KMS for auditing.

Visual Anchors

The Envelope Encryption Flow

KMS Key Hierarchy & Responsibility

Definition-Example Pairs

• Data Classification: The process of labeling data based on sensitivity.
  • Example: Using Amazon Macie to tag S3 objects as "PII" or "Internal Only" based on content patterns like credit card numbers.
• Attribute-Based Access Control (ABAC): Controlling access based on tags rather than fixed names.
  • Example: Allowing a developer to use a KMS key only if the key's tag Project matches the user's Project tag.
• Automated Credential Rotation: Updating secrets without manual intervention.
  • Example: Configuring AWS Secrets Manager to rotate an RDS password every 30 days via a Lambda function.

Worked Examples

Example 1: Creating a Cross-Account KMS Key Policy

To allow an IAM role in Account B (555566667777) to use a KMS key in Account A, you must update the Key Policy in Account A:

[!IMPORTANT] For cross-account access to work, the IAM role in Account B also needs an identity-based policy allowing the kms actions on the Key's ARN.

Checkpoint Questions

1. What is the maximum size of data that can be directly encrypted using a KMS Key without envelope encryption? ($4 KB$)
2. Which KMS key type allows the customer to define the rotation schedule and key policy? (Customer Managed Key)
3. How does AWS CloudHSM differ from AWS KMS regarding tenancy? (CloudHSM is single-tenant/dedicated; KMS is multi-tenant).
4. Which service would you use to automatically discover unencrypted sensitive data in S3? (Amazon Macie).

Muddy Points & Cross-Refs

• AWS Managed vs. AWS Owned Keys: You can see AWS Managed Keys (e.g., aws/s3) in your account and view their policies, but you cannot change them. You cannot see or manage AWS Owned Keys; they are used by AWS services behind the scenes.
• Key Deletion: You cannot delete a KMS key immediately. There is a mandatory waiting period of 7 to 30 days to prevent accidental data loss.
• CloudHSM Integration: Use KMS with a "Custom Key Store" if you need to use KMS APIs but want the keys stored on a dedicated CloudHSM cluster.

Comparison Tables

KMS Key Type Comparison

KMS vs. Secrets Manager