S3 - Encryption Flashcards
What are the four methods for encrypting objects in Amazon S3?
Server-Side Encryption (SSE):
SSE-S3
SSE-KMS
SSE-C
Client-Side Encryption
What is SSE-S3, and how does it work?
Uses S3-managed keys (AES-256).
Keys are managed and owned by AWS.
To enable, set the header: “x-amz-server-side-encryption”: “AES256”.
Enabled by default for new buckets and objects.
What is SSE-KMS, and how does it differ from SSE-S3?
Uses AWS Key Management Service (KMS) for encryption.
Offers user control over keys.
Keys are logged in AWS CloudTrail.
To enable, set the header: “x-amz-server-side-encryption”: “aws:kms”.
Requires KMS API calls, which count toward API quotas.
What is SSE-C, and what is unique about it?
Uses customer-provided encryption keys.
Keys are managed outside AWS and sent via HTTPS.
Amazon S3 discards the key after encryption.
HTTPS is mandatory for secure transmission.
What is client-side encryption, and how does it work?
Encryption is performed by the client before uploading data to S3.
Clients manage the keys and encryption process.
Encrypted data is stored in S3 as-is.
Decryption occurs on the client side.
What is encryption in transit, and why is it important?
Ensures secure data transmission between client and server using SSL/TLS.
Recommended to use HTTPS for secure connections.
Required for SSE-C encryption.
How can you enforce encryption in transit for an S3 bucket?
Use a bucket policy to deny HTTP access. Set ‘SecureTransport’ to ‘False’ which requires HTTPS.
What are the key advantages of SSE-KMS?
User control over encryption keys.
Logs key usage in CloudTrail.
Enhanced security by requiring access to both the object and the KMS key.
What are the limitations of SSE-KMS?
Requires KMS API calls, which have rate limits (5,000–30,000 requests/second).
High throughput applications may encounter throttling.
How can you force a specific type of encryption on an S3 bucket?
Use a bucket policy and state that any API calls without a specific encryption header will be rejected.
What is Cross Origin Resource Sharing (CORS)?
It’s a mechanism that allows requests from one origin (e.g. a static web page) to access objects in another bucket. You must enable CORS on the second bucket.
