30. Security & Encryption **IMPORTANT** Flashcards
What is encryption in flight?
SSL/TLS (HTTPS)
What is server-side encryption at rest
Data is encrypted after being received by the server and is decrypted before being sent (KMS)
What is client-side encryption?
Data is encrypted by client and never decrypted by server
What standard does KMS use for symmetric encryption?
AES-256
What standard does KMS use for asymmetric encryption?
RSA & ECC key pairs
What is the KMS data per call maximum?
4KB of data per call
What should you use if your KMS data is greater than the maximum?
If data > 4KB, use envelope encryption
What should you do in KMS to authorize cross-account access?
Attach a KMS Key Policy to authorize cross-account access
True or False: KMS keys have a global view.
False. KMS keys are bound to the region they are in.
What is the API used for envelope encryption?
GenerateDataKey
What is the API for data key caching?
LocalCryptoMaterialsCache
What is the API for creating a unique symmetric data key (DEK)?
GenerateDataKey
What is the API for encrypting data 4KB or less?
Encrypt
What is the API for generating a DEK for later use (not immediately)?
GenerateDataKeyWithoutPlaintext
When you exceed a KMS request quota, what happens?
You get a ThrottlingException
What are the possible solutions for resolving a KMS ThrottlingException?
- exponential backoff
- For GenerateDataKey, use DEK caching from the Encryption SDK
- you can request a quota increase through API or AWS support
True or False: Shared KMS request quotas vary with the AWS Region and the type of CMK used in the request.
True
What are the 4 methods of encrypting objects in S3?
- SSE-S3
- SSE-KMS
- SSE-C
- Client-side Encryption
What is SSE-S3?
SSE-S3 encrypts S3 objects using keys handled and managed by AWS
What is SSE-KMS?
SSE-KMS leverages KMS to manage encryption keys
What is SSE-C?
SSE-C is when you want to manage your own encryption keys
What are the advantages of SSE-KMS?
user control and audit trail
What header must be set for SSE-KMS?
“x-amz-server-side-encryption”: “aws:kms”
What API calls does SSE-KMS leverage?
GenerateDataKey and DecryptKMS
these KMS API calls will show up in CloudTrail
What do you need to perform SSE-KMS?
- A KMS Key Policy that authorizes the user / role
- An IAM policy that authorizes access to KMS
(otherwise you’ll get an access denied error)
True or False: S3 calls to KMS for SSE-KMS do not count against your KMS limits.
False.
S3 calls to KMS for SSE-KMS do count against your KMS limits.
How can you enforce SSL on an S3 bucket?
Create an S3 bucket policy with a DENY on the condition aws:SecureTransport = false
What is SSM Parameter Store?
AWS Systems Manager Parameter Store
- secure, hierarchical storage for configuration data management and secrets management
- simple API
- KMS encryption is optional
- can integrate with CloudFormation
- can track versions
- 2 tiers: Standard (free) and Advanced ($)
What is AWS Secrets Manager?
- protect secrets needed to access your applications and services
- Capability to force rotation of secrets
- automatic creation of secrets on rotation (using Lambda)
- KMS encryption is mandatory
- integration with RDS and CloudFormation
How does KMS encryption work?
KMS stores the CMK, and receives data from the clients, which it encrypts and sends back
Which AWS entities can be used to deploy SSL/TLS server certificates?
AWS Certificate Manager and IAM
Which is less expensive: SSM Parameter Store or Secrets Manager?
SSM Parameter Store
What would you suggest for someone who wants to rotate their keys?
Secrets Manager
How should you store secrets in CodeBuild?
DO NOT STORE THEM AS PLAINTEXT IN ENVIRONMENT VARIABLES
Use environment variables to reference parameter store parameters or secrets manager secrets.
Are CloudTrail event log files encrypted by default?
Yes, with S3 Server-Side Encryption (SSE)
KMS stores what types of keys?
Master keys (not data keys)
KMS can be used with what AWS service to audit keys access history?
CloudTrail
What are the primary resources in KMS?
Customer Master Keys (CMKs)
What level of compliance does KMS have?
FIPS 140-2 Level 2 compliant
What is the KMS command to turn on automatic key rotation?
> aws kms enable-key-rotation
only for symmetric keys
What should you use to store database credentials?
Secrets Manager
It will store and automatically rotate your database credentials
What should you use to block a single IP address?
NACL
Are NACLs stateful or stateless?
Stateless (incoming rule will not be applied to outgoing)
Are Security Groups stateful or stateless?
STATEFUL (if traffic is allowed inbound, it is also allowed outbound)
Can a Security Group block a single IP address?
No. You cannot block specific IP addresses with Security Groups, for this you would need a Network Access Control List (NACL)
