Chapter 5 Encryption on AWS Flashcards
Three ways to create keys with KMS
- KMS
- AWS CloudHSM
- importing your own key material
Default key rotation
Once a year without having to re-encrypt what was already encrypted
CMK
Customer Master Key. Used to control access to your data encryption keys (data keys) and to encrypt and decrypt your data.
Where are CMKs stored?
Within a CloudHSM in a single region. The CloudHSM is configured for multi tenancy by default, but you can use single tenant if necessary.
KMI
Key Management Infrastructure. Can be hosted by you or AWS.
Caveat of encrypting at block-level or file level
Cannot encrypt an EBS boot volume.
How to encrypt RDS data via client side technology?
Encrypt data before writing to the DB. You can also add HMAC field to DB so that you query against that value instead of exposing plaintext values in queries.
S3 server side encryption mechanism (managed)
S3 can encrypt data written to disk in S3. Each object has its own data key. This is offered at no additional charge
Explain S3 server side encryption via customer provided key
You provide key during upload, and S3 uses it to encrypt objects. Then it deletes the provided key. When you download from S3, you provide your key again, and S3 will decrypt object and send it. (no additional cost)
Explain S3 server side encryption via KMS
When you upload object, request sent to KMS for object key. KMS responds with object key in two forms (1. encrypted from master key and 2. plaintext version). Then, S3 encrypts object via plaintext key and deletes the plaintext key. Now S3 holds both the encrypted object and encrypted object key.
When it needs to retrieve an object, S3 sends KMS the encrypted object key. KMS decrypts the object key and returns it. Then S3 can decrypt the object itself.
KMI anatomy
- Storage layer that protects plaintext keys
2. Management layer that authorizes use of stored keys
Options for encryption via KMI
- You control encryption method in addition to the entire KMI
- You control the encryption method and the management layer of the KMI, and AWS handles storage layer
- AWS controls the encryption method and both components of the KMI
Which AWS service provides asymmetric and symmetric encryption capabilities?
CloudHSM
Which feature of AWS Key Management Service (AWS KMS) enables you to use an AWS CloudHSM cluster for the storage of your encryption keys?
Custom Key Stores
Difference b/t SSE-S3 and SSE-KMS
SSE-S3 does not use KMS (no CMK). SSE-S3 manages encryption keys and performs rotations periodically for you. SSE-S3 is less hands on.
