S3 6 Flashcards
Encryption: theory
What are the two types of keys used in S3 object encryption?
Data Encryption Keys (DEKs) and Key Encryption Keys or master keys
Encryption: theory
What is a DEK?
Per-object key created by a Key Encryption Key
Encryption: theory
Informal name for a Key Encryption Key, noting its use?
“Wrapping key”
Encryption: theory
What’s the informal name for using a two-stage key set up for encryption?
“Envelope encryption”
Encryption: SSE
How do you encrypt a bucket?
Technically can’t. Objects are encrypted, not buckets.
Encryption: SSE
What are three types of server-side encryption?
SSE-S3, SSE-C, SSE-KMS
Encryption: SSE
What is bucket default encryption?
Set on whole bucket. If PutObject isn’t explicit, this is the type of encryption used.
Encryption: SSE
How do you force a certain level of encryption across a whole bucket?
Can’t, but can set conditions on s3:PutObject in Policies
Encryption: SSE-S3
How does SSE-S3 work?
S3 creates and manages the keys, not visible to users at all.
Encryption: SSE-S3
Specific sequence for SSE-S3 PutObject?
S3 creates symkey, encrypts obj. S3 master key encrypts object-specific key, stores with object, tosses original key.
Encryption: SSE-S3
Specific sequence for SSE-S3 GetObject?
Get encrypted object key, unencrypt with S3 master key, use object key to unencrypt object.
Encryption: SSE-S3
What type of key + cipher does SSE-S3 use?
AES-256 symmetric, block-cipher key
Encryption: SSE-KMS
How does SSE-KMS work?
Similar to SSE-S3 sequence, but KMS holds onto the root key
Encryption: SSE-KMS
What specifically does KMS send back when S3 asks for an object key during PutObject?
New unencrypted object key + encrypted version of same key
Encryption: SSE-KMS
What does S3 do with the un- and encrypted keys sent from KMS for PutObject?
Encrypt obj with unencrypted key, toss it, store encrypted obj and encrypted key.
Encryption: SSE-KMS
What does S3 send and get back from KMS on GetObject?
Send encrypted object key, get unencrypted object key (uses KMS key to decrypt it)
Encryption: SSE-KMS
Can you use customer-uploaded keys in KMS for SSE-KMS?
Yes
Encryption: SSE-KMS
What’s the down-side of custom KMS keys for SSE-KMS?
You manage the key rotation and re-encryption of S3 objects with previous KMS key
Encryption: SSE-KMS
How do you handle key rotation and object re-encryption with AWS-managed SSE-KMS?
You don’t, all of this is automatic and done for you.
Encryption: SSE-KMS
What are S3 Bucket Keys?
Keys created by KMS, stored unencrypted with the bucket
Encryption: SSE-KMS
Can you use S3 Bucket Keys with KMS?
Yes, that’s literally what it’s designed for
Encryption: SSE-KMS
Can you use S3 Bucket Keys with SSE-S3?
No, KMS unused for all SSE-S3 operations
Encryption: SSE-KMS
Advantage of using S3 Bucket Keys?
Save money
Encryption: SSE-KMS
What happens with S3 Bucket Keys on PutObject?
S3 Bucket key used to create object key and encrypted object key, same as with SSE-KMS
Encryption: SSE-KMS
What happens with S3 Bucket Keys on GetObject?
Encrypted object key decrypted with S3 Bucket key, unencrypted obj key decrypts object
Encryption: SSE-KMS
What kinds of KMS keys are automatically tracked and audited with CloudTrail?
All of them: AWS-managed and customer managed keys.
