Data protection

Data in transit

Requiring encryption

• Load balancers: HTTPS/TLS listeners with an ACM or imported certificate and an ELB security policy that sets the minimum TLS version and ciphers (for example a policy that supports TLS 1.2 and 1.3 only; there are also FIPS and post-quantum hybrid policies). ALB can redirect HTTP to HTTPS. NLB supports TLS listeners and passes TCP through if you want end-to-end encryption. ALB can also do mutual TLS with a trust store.
• CloudFront: viewer protocol policy (redirect to HTTPS), minimum TLS security policy, and origin protocol policy HTTPS-only. API Gateway: custom domains with a TLS security policy; mutual TLS on custom domains.
• S3: bucket policy Deny when aws:SecureTransport is false; optionally enforce a minimum TLS version with the s3:TlsVersion condition.
• Databases: RDS/Aurora rds.force_ssl parameter (PostgreSQL), require_secure_transport (MySQL); download the RDS CA bundle and verify the server certificate. Redshift require_ssl. OpenSearch domain setting require HTTPS and TLS policy. DynamoDB, KMS and most APIs are always HTTPS.
• SMTP/other: SES requires TLS options per configuration set; MSK client-broker encryption TLS.
• Certificates: ACM provisions and renews public certificates for integrated services (ELB, CloudFront, API Gateway) at no cost; they can’t be exported. ACM exportable public certificates exist as a paid option. AWS Private CA issues private certificates for internal use.
• Enforce at scale with Config rules (alb-http-to-https-redirection-check, elb-tls-https-listeners-only), SCPs and Security Hub controls.

Secure and private access

Endpoint details:

• Endpoint policies limit what a principal may do through the endpoint (for example only your buckets). Combine with aws:SourceVpce in the bucket policy so the bucket only accepts requests via the endpoint.
• Interface endpoints need private DNS enabled for the default service name to resolve to the endpoint. Security groups protect them. Gateway endpoints work through route tables and prefix lists and don’t extend outside the VPC (not reachable over VPN or peering without extra design).
• Resolver endpoints and DNS hybrid arrangements for private names.

Inter-resource encryption

For anything not covered by the platform, put TLS on the application path (sidecar, mesh, or app-level) and use ACM Private CA certificates.

Data at rest

Key services: KMS vs CloudHSM

A KMS custom key store backed by CloudHSM keeps the KMS API but stores key material in your cluster. An external key store (XKS) keeps key material in an HSM outside AWS, and KMS calls it through an XKS proxy; latency and availability depend on that proxy. XKS suits “keys must never be in AWS” rules, accepting the operational cost.

Encryption approach

Envelope encryption: KMS generates a data key; you encrypt data locally and store the encrypted data key beside it. Encrypt direct API is limited to 4 KB, so large data uses data keys (GenerateDataKey, GenerateDataKeyWithoutPlaintext). The AWS Encryption SDK does this and supports multi-key (keyrings) and caching.

Service defaults: RDS, EBS, EFS, DynamoDB, Redshift, SQS and others offer KMS encryption. RDS encryption must be set at creation; to encrypt an unencrypted DB, snapshot → copy snapshot with a key → restore. EFS is encrypted at creation. DynamoDB always encrypts (AWS owned, AWS managed or customer managed key).

KMS in depth

• Key types: symmetric (AES-256-GCM), asymmetric (RSA, ECC; sign/verify or encrypt/decrypt; public key downloadable), HMAC keys. AWS owned, AWS managed (aws/service, rotates yearly automatically, policy not editable), customer managed (you control).
• Key policy is required and primary. IAM policies only work if the key policy allows the account (the default statement allowing the account root). Grants give programmatic, temporary permissions to a grantee principal (used by services, such as EBS, RDS, Auto Scaling) and can be retired.
• Cross-account: the key policy allows the external account, and an IAM policy in that account allows the principal to use the key. AWS managed keys can’t be used cross-account.
• Rotation: customer managed symmetric keys can auto-rotate (rotation period configurable, 90–2560 days, default 365) or rotate on demand. The key ID and ARN stay the same; old backing material stays to decrypt old data. Asymmetric and HMAC keys and keys with imported material don’t rotate automatically; rotate by creating a new key and updating the alias. AWS managed keys rotate automatically.
• Key states: Enabled, Disabled (reversible), Pending deletion (7–30 day waiting period, can cancel), Pending import. Deleting a key makes data unreadable; prefer disabling, and alarm on ScheduleKeyDeletion events.
• Multi-Region keys: a primary and replicas that share the same key ID and material (replicas independent in policy) so data encrypted in one Region decrypts in another; used for DR, global tables, and client-side encryption. They’re not automatically synchronised in policy and rotation is handled at the primary.
• Encryption context: non-secret AAD bound to ciphertext; logged in CloudTrail; use in conditions (kms:EncryptionContext:*) and grants.
• Condition keys: kms:ViaService (only via a named AWS service), kms:CallerAccount, kms:GrantIsForAWSResource, kms:EncryptionContext.
• Limits that show up: request quotas per second per Region (shared across keys; throttling ThrottlingException), 4 KB direct encrypt limit, 100,000 aliases per account.
• Monitoring: CloudTrail logs every KMS API call, and EventBridge can react to key state changes. Config rule cmk-backing-key-rotation-enabled.
• A KMS key deleted or disabled makes encrypted EBS volumes, RDS instances and S3 objects inaccessible, which is also the revoke tool in ransomware or leak cases.

Imported key material and external key stores

Import steps: create a key with origin External, download a wrapping public key and import token (RSAES_OAEP_SHA_256 or similar), wrap your key material with it, import. You can re-import the same material only (to restore after deletion or expiry). Multi-Region keys can have imported material, but you must import the same material into each replica. Use this when policy says “we generate our own keys” or “we need the ability to destroy material on demand”.

Integrity and immutability

Lifecycle and retention

• S3 Lifecycle: transitions between classes (Standard-IA, Glacier tiers) and expiry, also for noncurrent versions and incomplete multipart uploads. Intelligent-Tiering automatically moves objects. Lifecycle can’t delete objects under Object Lock retention.
• EFS lifecycle: move files to IA/Archive after a period; EFS with AWS Backup.
• FSx for Lustre supports automatic daily backups with a retention period; on S3-linked file systems data repository tasks.
• Data Lifecycle Manager (DLM) schedules EBS snapshots and AMIs with retention, cross-Region/account copy, and fast snapshot restore.
• DynamoDB TTL, CloudWatch Logs retention, RDS automated backup retention (up to 35 days).
• Retention for compliance: set it in policy, and use Object Lock or vault lock for legal holds.

Replication and backup

• AWS Backup: central policy-based backup across EBS, EC2, RDS, Aurora, DynamoDB, EFS, FSx, S3, DocumentDB and more. Backup plans (rules: schedule, lifecycle, vault, copy), vaults with KMS encryption, cross-Region and cross-account copy, organization backup policies, Vault Lock, logically air-gapped vault (isolated, restores shared through RAM), restore testing, audit manager reports, and malware scanning of backups.
• Ransomware protection: immutable backups, separate recovery account with different credentials, MFA delete, versioning, S3 replication to another account with a different KMS key, Object Lock, tested restores, and least-privilege for backup deletion (SCP denying backup:DeleteRecoveryPoint).
• S3 replication (CRR/SRR): needs versioning on both sides; replicates new objects (use Batch Replication for existing); KMS-encrypted objects require replication to be configured with the destination key and role permissions; can change ownership to the destination account; Replication Time Control gives a 15-minute SLA. Delete markers aren’t replicated by default.
• DataSync: encrypted (TLS) transfer of data between on-premises, AWS storage and other clouds, with integrity checks and scheduled tasks. Storage Gateway, Transfer Family (SFTP into S3/EFS) with encrypted transport, and Snow family use KMS-wrapped keys for offline transfers.
• RDS/Aurora: automated backups, snapshots (copy cross-Region, re-encrypt with a new key), cross-Region read replicas, Aurora Global Database.
• DynamoDB: PITR (35 days), on-demand backups, global tables.

Confidential data, credentials, secrets and keys

Secrets Manager vs Parameter Store

Rotation design:

• Rotation uses a Lambda rotation function with four steps (createSecret, setSecret, testSecret, finishSecret) and staged labels AWSCURRENT, AWSPENDING, AWSPREVIOUS. The alternating users strategy keeps one user valid while the other rotates, avoiding downtime for apps that cache credentials; the single user strategy is simpler but briefly risks failed logins.
• The Lambda needs network access to the database and to Secrets Manager (VPC endpoint), and permission on the secret and KMS key.
• Applications fetch the secret at runtime (cache it with the caching client), never bake it in. Use IAM database authentication (RDS/Aurora token valid 15 minutes) when you can avoid passwords altogether.
• Resource policy with aws:PrincipalOrgID shares a secret across an organization; deletion has a recovery window of 7–30 days; stop deletion with an SCP or policy.
• Rotation for third-party secrets uses a custom Lambda.
• Detect secrets in code with CodeGuru/Q Developer secrets detection.

Masking sensitive data

• CloudWatch Logs data protection policies detect and mask sensitive data (managed data identifiers such as credit card numbers, email, AWS secret keys, or custom identifiers) in log events as they’re ingested. Principals with logs:Unmask see the original. Findings can go to S3, CloudWatch Logs or Firehose. Applied per log group or account-wide.
• SNS message data protection policies audit, de-identify (mask or redact) or deny messages containing sensitive data in topics.
• Macie finds sensitive data already in S3. Bedrock Guardrails sensitive information filters mask PII in generative AI. S3 Object Lambda can redact data on read. Redshift dynamic data masking and Lake Formation column/row/cell-level security limit exposure in analytics.
• Tokenisation and truncation in the application; avoid logging secrets in the first place.

Keys and certificates across Regions and accounts

• KMS customer managed keys: one per application or data class; multi-Region keys where data moves (DR, global tables, replicated S3 data); aliases (alias/app) decouple code from the key ID and make manual rotation easy.
• Cross-Region encrypted copies (snapshots, AMIs, backups) must be re-encrypted with a key in the destination Region, since a single-Region key doesn’t exist there.
• AWS Private CA: a managed private certificate authority hierarchy (root and subordinate CAs); issues certificates for internal TLS, device identities (IoT, Roles Anywhere trust anchor), mTLS and code signing. Supports CRL and OCSP revocation, short-lived certificates (cheaper mode), cross-account sharing with RAM, and ACM integration for managed renewal on integrated services. Keep the root CA in a locked-down account, use subordinate CAs for issuing.
• ACM: public certs (DNS or email validation; DNS validation auto-renews), imported certs (you renew them; Config/EventBridge expiry alerts), and ACM Private CA certs.
• CloudHSM clusters in multiple AZs for HA; keys sync across HSMs in the cluster; backups are encrypted and stored in S3.

Common traps

• A KMS key policy that omits the account root lock-out: IAM policies don’t work and you may need Support.
• AWS managed keys can’t be shared cross-account, so encrypted snapshots/AMIs using them can’t be shared.
• Imported material doesn’t rotate automatically; auto-rotation keeps the key ID (not an alias change).
• Disabling or deleting a key breaks everything encrypted with it; a waiting period protects you.
• Governance mode can be overridden; compliance mode can’t. Object Lock needs versioning.
• Secrets Manager rotates; Parameter Store doesn’t.
• SSE-KMS adds KMS calls and throttling; Bucket Keys reduce them.
• ACM public certs can’t be installed on EC2 directly (not exportable by default). CloudFront needs the cert in us-east-1.
• RDS can’t be encrypted in place.
• Gateway endpoints don’t work from on-premises over VPN/Direct Connect.