26. AWS Security & Encryption: KMS, SSM, Parameter Store, CloudHSM, Shield, WAF

Question 1

Encryption in flight (SSL)

Answer 1

• Data is encrypted before sendind and decrypted after receiving.
• SSL certificates help with encryption (HTTPS)
• Encryption in flight ensures no MITM (man in the middle attack) can happen

Question 2

Server side encryption at rest

Answer 2

• Data is encrypted after being received in the server
• Data is decrypted before sent
• It is stored in an encrypted form thank to a key (usually a data key)
• The encryption/decryption keys must to managed somewhere and the server must have access to it.

Question 3

Client side encryption

Answer 3

• Data is encrypted by the client and never decrypted by the server
• Data will be decrypted by a receiving client
• The server should not be able to decrypt the data
• Could laverage Envelope Encryption

Question 4

AWS KMS (Key Management Service)

Answer 4

• Anytime you hear “encryption” for an AWS service, it’s most likely KMS.
• AWS manages encryption keys for us.
• Fully integrated with IAM for authorization
• Easy way to control access to your data
• Able to audit KMS key usage using CloudTrail
• Seamlessly integrated into most AWS service (EBS, S3, RDS, SSM…)

Question 5

KMS Keys Types

Answer 5

• KMS Keys is the new name of KMS Cutomer Master Key
• Symmetric (AES-256 keys)
  Single encryption key that is used to Encryupt and Decrypt
  AWS service that are integrated with KMS use Symmetric CMKs
  You never get acces to the KMS Key unencrypted (must call KMS API to use)
• Asymmetric (RSA & ECC key pairs)
  Public (Encrypt) and Private key (Decrypt) pair
  Used for Encrypt/Decrypt, or Sign/Verify operations
  The public is downloadable, but you can’t access the Private Key unnencrypted

Question 6

Use case of Assymetric KMS key

Answer 6

• Encryption outside of AWS by users who can’t call the KMS API

Question 7

AWS KMS (Key Management Service)

Answer 7

• Type of KMS Keys
  AWS Oned Key (free): SSE-S3, SSE-SQS, SSE-DDB(default key)
  AWS Managed key: free (aws/service-name, example: aws/rds or aws/ebs)
  Customer managed keys created in KMS: $1/month
  Customer managed keys imported (must be summetric key): $1 / month
  + [au fpr API call to KMS ($0.03/10000 calls)

Question 8

AWS KMS - Rotations keys

Answer 8

• AWS managed KMS Keys: automatic every 1 year
• Costomer-managed KMS Keys: (must be enabled) automatic every 1 year
• Imported KMS Key: only manual rotation possible using alias

Question 9

KMS Key Policies

Answer 9

• Control access to KMS keys, “similar” to S3 buckets policies
• Difference: you cannot control acces without them

Question 10

Default KMS Key Policy:

Answer 10

• Created if you don’t provide a specific KMS Key Policy
• Complete access to the key to use the root user = entire AWS account

Question 11

Custom KMS Key Policy:

Answer 11

• Define users, roles that can acces ot the KMS keyu
• Define who can administer the key
• Define for cross-account access of your KMS key

Question 12

AMI Sharing Process Encrypted via KMS

Answer 12

1. AMI in Source Account is encrypted with KMS Key from Source Account
2. Must modify the image attribute to add a Launch Permission wich correspondds to the specified target AWS Account
3. Must share the KMs keys used to encrypted the snapshot the AMI reference
4. The IAM Role/User in the target account must have the permission to DeescribeKey, ReEncrypted, CreateGrant, Decrypt
5. When launching an EC2 instance from the AMI, optionally the target account can specify a new KMS key in its own account to re-encrypt the volume

Question 13

S3 Replication

Answer 13

• Unencrypted objects and objects encrypted with SSE-S3 are replicated by default
• Object encrypted with SSE-C (customer provided key) are never replicated.

Question 14

SSM Parameter Store

Answer 14

• Secure storage form configuration and secrets
• Optional Seamless Encryption using KMS
• Serverless, scalable, durable, easy SDK
• Version tracking of configuration / secrets
• Security throught IAM
• Notification with Amazon EventBridge
• Integration with CloudFormation

Question 15

AWS Secret Manager

Answer 15

• Meant for storing secrets
• Capability to force rotation of secrets every X days
• Automate generation of secrets on rotation (use Lambda)
• Integration with Amazon RDS (MySQL PostgresSQL, Aurora)
• Secrets are encrypted using KMS

Question 16

AWS Secret Manager - Use cases

Answer 16

• Mostly meant for RDS Integration

Question 17

AWS Secrets Manager - Multi region secret

Answer 17

• Replicate Secrets accross multiple AWS Regions
• Secrets Manager keeps read deplicas in sync with the primary Secret
• Ability to promote a read replica Secret to a standalone Secret
• Use cases: multi region apps, disaster recovery, disaster recovery strategies, multi-region DB