Module 9: Securing Data - Advanced Architecting on AWS

🎯 Module Objectives

Design encryption strategies with AWS KMS (key types, policies, rotation)
Implement envelope encryption for large data
Deploy CloudHSM for dedicated key management
Manage certificates with AWS Certificate Manager (ACM)
Secure credentials with Secrets Manager
Encrypt data at rest for S3, RDS, DynamoDB, and EBS

🔑 AWS KMS Key Types

Key Type	Management	Rotation	Use Case
AWS Owned Keys	AWS manages entirely	Varies	Default encryption (S3 SSE-S3)
AWS Managed Keys	AWS creates per service (aws/s3, aws/ebs)	Auto (yearly)	Simple encryption without custom policy
Customer Managed Keys (CMK)	You create, manage policies	Configurable (90-2560 days)	Cross-account, custom policies, auditing
Imported Key Material	You provide key material	Manual only	Compliance requiring external key origin

Decision guide: Need cross-account access or custom key policies? → Customer Managed Key. Simple encryption with no special requirements? → AWS Managed Key.

📨 Envelope Encryption

Problem: KMS can only encrypt up to 4KB directly
Solution: Generate a Data Key → encrypt data locally → store encrypted data + encrypted data key
GenerateDataKey API: Returns plaintext + encrypted copy of the data key
Decrypt flow: Call KMS to decrypt the data key → use plaintext key to decrypt data
Performance: Data never leaves your application for encryption — only the small key goes to KMS

Analogy: Envelope encryption is like a safe (KMS) that stores the key to your filing cabinet (data key). You use the filing cabinet key locally to lock/unlock documents. Only the cabinet key goes back to the safe.

🏦 AWS CloudHSM

Feature	KMS	CloudHSM
Management	Multi-tenant, AWS-managed	Single-tenant, customer-managed
HSM Type	FIPS 140-2 Level 3	FIPS 140-2 Level 3
Key access	AWS has administrative access	Only you have key access (AWS cannot recover)
Integration	Native AWS service integration	PKCS#11, JCE, OpenSSL, Microsoft CNG
Use case	Most encryption needs	Regulatory requirements, Oracle TDE, SSL offload
Pricing	Per-API call + per-key/month	~$1.50/hr per HSM (minimum 2 for HA)

📜 ACM & Secrets Manager

AWS Certificate Manager

Free public SSL/TLS certificates. Auto-renewal. Integrates with ALB, CloudFront, API Gateway. Private CA available.

Secrets Manager

Store & rotate secrets (DB creds, API keys). Lambda rotation function. Cross-account sharing. Automatic rotation (30/60/90 days).

ACM vs. self-managed certs: ACM auto-renews, no manual cert management needed
Secrets Manager vs. Parameter Store: SM has built-in rotation, costs $0.40/secret/month. PS is free for standard params.

🔐 Encryption at Rest Summary

Service	Encryption Method	Key Options
S3	SSE-S3, SSE-KMS, SSE-C, client-side	Bucket keys reduce KMS costs
EBS	AES-256 (default encryption available)	AWS managed or CMK
RDS	AES-256 at volume level	Must enable at creation (immutable)
DynamoDB	AES-256 (always encrypted)	AWS owned, AWS managed, or CMK
EFS	AES-256	Must enable at creation

💻 Demo: KMS Key Management

# Create a CMK
aws kms create-key --description "Production encryption key" \
  --key-usage ENCRYPT_DECRYPT --key-spec SYMMETRIC_DEFAULT

# Generate a data key (envelope encryption)
aws kms generate-data-key --key-id alias/prod-key \
  --key-spec AES_256

# Enable automatic rotation
aws kms enable-key-rotation --key-id alias/prod-key \
  --rotation-period-in-days 90

# Grant cross-account access
aws kms create-grant --key-id alias/prod-key \
  --grantee-principal arn:aws:iam::222233334444:role/AppRole \
  --operations Decrypt GenerateDataKey

🧪 Knowledge Check

Q1: An application encrypts files larger than 100MB before storing in S3. Which approach should it use?

A) Call KMS Encrypt API directly B) Envelope encryption with GenerateDataKey C) CloudHSM only D) Client-side encryption with AES library

B) Envelope encryption with GenerateDataKey — KMS can only encrypt 4KB directly. For large data, generate a data key via KMS, use it locally to encrypt the file, then store the encrypted data key alongside the encrypted file.

Q2: A company's compliance requires that AWS cannot access their encryption keys under any circumstances. What should they use?

A) AWS Managed KMS key B) Customer Managed KMS key C) CloudHSM D) SSE-S3

C) CloudHSM — CloudHSM provides single-tenant HSMs where only the customer has access to key material. AWS cannot recover or access keys in CloudHSM. KMS (even CMK) still has AWS administrative access to the infrastructure.

📝 Module 9 Summary

KMS

AWS owned/managed/customer keys. Envelope encryption for large data. Cross-account grants. Key rotation.

CloudHSM

Single-tenant. Customer-only key access. PKCS#11. Oracle TDE, SSL offload. ~$1.50/hr/HSM.

ACM & Secrets

Free public certs with auto-renewal. Secrets Manager for credential rotation. Lambda-based rotation.

Encryption at Rest

S3: SSE-S3/KMS/C. EBS: default encryption. RDS: enable at creation. DynamoDB: always encrypted.