Mastering AWS Encryption: KMS and S3 Security Patterns

This guide covers the core concepts of data protection on AWS, focusing on the Key Management Service (KMS) and Amazon S3 encryption options required for the DVA-C02 exam.

Learning Objectives

After studying this guide, you should be able to:

• Define the difference between encryption at rest and encryption in transit.
• Differentiate between the four types of S3 Server-Side Encryption (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C).
• Explain the mechanism of Envelope Encryption using KMS Data Keys.
• Identify appropriate KMS API calls for specific encryption tasks (Encrypt, GenerateDataKey, etc.).

Key Terms & Glossary

• KMS (Key Management Service): A managed service that makes it easy to create and control the cryptographic keys used to protect your data.
• CMK (Customer Master Key): A logical representation of a master key in KMS, now often referred to simply as a KMS Key.
• Data Key: A cryptographic key generated by KMS using a KMS Key, used to encrypt large amounts of data outside of KMS.
• Envelope Encryption: The practice of encrypting data with a data key, and then encrypting the data key under another key (the KMS Key).
• Encryption at Rest: Data encrypted while stored on physical media (e.g., EBS volumes, S3 objects).
• Encryption in Transit: Data encrypted while traveling across the network (e.g., via SSL/TLS).

The "Big Idea"

Security in the cloud is a shared responsibility. While AWS secures the infrastructure, developers must ensure data is unreadable to unauthorized parties. AWS KMS acts as the central "brain" for security, integrating with almost every AWS service to provide a seamless way to handle keys without the developer ever needing to handle the raw master key material directly. This separation of "Master Key" (KMS) and "Data Key" (Local) allows for high-performance encryption of large datasets while maintaining centralized auditing and control.

Formula / Concept Box

S3 Encryption Headers

When performing a PUT operation to S3, the header determines the encryption type:

[!IMPORTANT] As of January 5, 2023, S3 applies SSE-S3 by default to all new objects at no additional cost if no other method is specified.

Hierarchical Outline

1. Encryption Fundamentals
   • In Transit: Protects data en route using SSL/TLS.
   • At Rest: Protects data on disk; requires decryption before reading.
2. AWS KMS (Key Management Service)
   • FIPS 140-2 Level 3 compliant hardware security modules (HSMs).
   • Key APIs:
     • Encrypt: Max 4 KB data limit (for passwords, small secrets).
     • GenerateDataKey: Returns a plaintext data key and an encrypted version.
     • Decrypt: Decrypts the encrypted data key back to plaintext.
   • Rotation: Can be enabled/disabled to improve security posture.
3. Amazon S3 Encryption Options
   • Server-Side (SSE): AWS handles encryption/decryption on the server.
   • Client-Side: You encrypt data before sending it to AWS.

Visual Anchors

Envelope Encryption Flow

S3 Encryption Architecture

Definition-Example Pairs

• SSE-S3 (S3-Managed Keys)
  • Definition: S3 manages the keys and handles the AES-256 encryption automatically.
  • Example: A developer uploads a profile picture to a public bucket; S3 encrypts it instantly without the developer providing any keys.
• SSE-KMS (KMS-Managed Keys)
  • Definition: Uses KMS keys to provide an audit trail and granular permissions (IAM/Key Policies).
  • Example: A financial app stores tax records; the security team uses KMS to see exactly when the "TaxRecordKey" was used and by whom.
• SSE-C (Customer-Provided Keys)
  • Definition: The customer provides the key in every API call; AWS uses it to encrypt/decrypt then immediately discards it from memory.
  • Example: A highly regulated bank wants to maintain total control of key material but use S3 for storage; they pass the key in the HTTPS header for every request.

Worked Examples

Scenario: Encrypting a 100MB File

Because KMS Encrypt only supports 4KB, we must use Envelope Encryption.

1. Request a Data Key: Call aws kms generate-data-key --key-id <Your-KMS-Key-ID> --key-spec AES_256.
2. Receive Keys: KMS returns Plaintext (the actual key) and CiphertextBlob (the encrypted key).
3. Local Encryption: The application uses the Plaintext key to encrypt the 100MB file using a library like OpenSSL or the AWS Encryption SDK.
4. Cleanup: The application must delete the Plaintext data key from memory.
5. Storage: The application stores the encrypted file and the CiphertextBlob together. To read the file later, the CiphertextBlob is sent back to KMS Decrypt to recover the Plaintext key.

Checkpoint Questions

1. What is the maximum data size that can be encrypted using the KMS Encrypt API?
2. True or False: In SSE-C, AWS stores your encryption key in a secure hidden vault.
3. Which S3 encryption method should be used if you require a multi-layer encryption approach for compliance?
4. What S3 header must be used to specify SSE-KMS during an upload?

▶Click to see answers

1. 4 KB. For anything larger, you must use GenerateDataKey (Envelope Encryption).
2. False. In SSE-C, AWS does not store the key; you must provide it for every request, and it is purged from memory after use.
3. DSSE-KMS (Dual-layer Server-Side Encryption).
4. x-amz-server-side-encryption: aws:kms.