Skip to content

2 · Data Protection — Revise

Security · 30% · Compressed recall. Read the Learn guide first.

Key facts

Fact Value
Encryption at rest KMS (S3, EBS, RDS, DynamoDB…)
Encryption in transit TLS (certs from ACM) + VPN / Direct Connect
KMS direct-encrypt limit ≤ 4 KB → bulk data uses envelope encryption (data keys)
KMS access root Key policy (resource policy) — IAM only works if key policy delegates to account
Grants Temporary, limited key-use delegation without editing key policy
Customer managed key rotation Opt-in, default 365 days, configurable + on-demand
AWS managed key rotation Automatic ~yearly, can't disable
Rotation effect Same key ID/ARN; old ciphertext still decrypts
KMS key deletion 7–30 day wait, default 30; no instant delete → prefer disable
Multi-Region keys Same key material replicated to other Regions (cross-Region DR)
CloudHSM Single-tenant, FIPS 140-2 L3, you own keys (TDE, strict mandates)

Pick the service

Store a secret WITH auto-rotation?      → Secrets Manager
Config value / secret, no rotation?     → SSM Parameter Store (SecureString via KMS)
Public TLS certificate?                 → ACM (free, auto-renew; CloudFront cert → us-east-1)
Must fully own keys / dedicated HSM?    → CloudHSM
Default at-rest encryption keys?        → KMS (customer managed if you need control/audit)
Find PII in S3?                         → Macie

S3 encryption options

Option Keys Note
SSE-S3 AWS-managed AES-256 Default on all new objects
SSE-KMS KMS key Audit trail + access control; high volume → S3 Bucket Keys
SSE-C You provide per request You manage keys
Client-side You, before upload AWS never sees plaintext

Encrypt an EXISTING unencrypted volume/DB

EBS volume / RDS instance (unencrypted)
   → snapshot
   → copy snapshot WITH encryption (KMS key)
   → create volume / restore DB from encrypted copy
   → cut over
(You CANNOT toggle encryption in place.)

Flashcards

Why can't a KMS key encrypt a 1 GB file directly? KMS direct encryption is limited to ≤ 4 KB. Bulk data uses envelope encryption: KMS issues a data key that encrypts the data; KMS only encrypts the data key.
User has IAM kms:Decrypt but gets AccessDenied. Likely cause? The key policy doesn't delegate to the account root or name the user. For KMS the key policy is the root of access — fix the key policy.
How do you encrypt an existing unencrypted RDS instance? Snapshot → copy snapshot with encryption → restore a new encrypted instance → cut over. Can't enable in place.
SSE-KMS is throttling / costing too much at high object volume. Fix? Enable S3 Bucket Keys — a bucket-level key reduces per-object KMS calls.
Where must a CloudFront TLS certificate live? ACM in us-east-1 (N. Virginia), regardless of origin Region.
Secrets Manager vs Parameter Store — which auto-rotates? Secrets Manager (native rotation for RDS etc.). Parameter Store standard has no native rotation (but SecureString is free + KMS-encrypted).
Default customer-managed KMS rotation period, and is it on by default? 365 days, and it's opt-in (off by default). AWS managed keys rotate yearly automatically.
Requirement: single-tenant hardware, AWS can't touch the keys. Service? AWS CloudHSM (FIPS 140-2 Level 3, you fully control keys). KMS is multi-tenant/AWS-operated.
Fastest way to know if S3 buckets contain PII? Amazon Macie (ML-based sensitive-data discovery/classification).
Can you delete a KMS key instantly? No — 7–30 day waiting period (default 30). Disable instead if unsure; can't delete AWS managed/owned keys.

Common traps

  • KMS = key policy first — IAM alone can't grant key use unless the key policy allows it.
  • ≤ 4 KB direct — everything else is envelope encryption.
  • No in-place encryption for existing EBS/RDS → snapshot-copy-restore.
  • S3 Bucket Keys for SSE-KMS cost/throttling.
  • CloudFront cert → us-east-1; ACM public certs → ELB/CloudFront/API GW (exportable-to-EC2 certs exist since 2025).
  • Auto-rotation ⇒ Secrets Manager, not Parameter Store.
  • Disable, don't delete KMS keys when unsure (7–30 day irreversible wait).