AWS Security · Domain 5
Data Protection
About 18% of the exam
KMS in one card
- Ask KMS for a data key
- Encrypt locally with the plaintext key
- Store the wrapped key alongside
- Discard the plaintext key
- Customer managed key
- you own policy and rotation
- AWS managed key
- service owned, policy not editable
- AWS owned key
- invisible, shared across customers
- Envelope encryption
- data key wrapped by KMS
- GenerateDataKey
- returns plaintext and wrapped key
- Key policy
- the root of key access
- Grant
- temporary programmatic delegation
- Multi-Region key
- same material replicated per Region
IAM alone cannot grant use of a KMS key unless the key policy delegates to the account root
Key operations
- Automatic rotation keeps the old material
- Rotation is transparent to existing ciphertext
- Imported material has to be rotated manually
- The import token expires within a day
- Deletion waits seven to thirty days
- CancelKeyDeletion rescues a pending key
- Disable is reversible, delete is not
CloudHSM and custom key stores
- CloudHSM gives single tenant hardware
- Validated modules with your own users
- A custom key store backs KMS with CloudHSM
- The cluster needs two active modules
- AWS cannot recover lost cluster credentials
- Choose it for strict custody requirements
S3 encryption options
- SSE-S3
- AWS managed, no key work
- SSE-KMS
- auditable key, policy controlled
- DSSE-KMS
- two layers of server-side encryption
- SSE-C
- you send the key each request
- Client-side
- encrypted before it reaches S3
- Bucket Keys
- fewer KMS calls, lower cost
- Default encryption
- applies when no header arrives
- Bucket policy
- deny uploads missing the header
S3 access protections
- Block Public Access at the account level
- The account setting overrides the bucket
- Object Ownership can disable ACLs
- Access points scope one use case
- VPC-only access points reject internet callers
- Object Lock in governance or compliance mode
- A presigned URL dies with its credential
Encrypting the rest of the estate
Block and file
- EBS default encryption per Region
- Snapshot copies can change key
- EFS and FSx encrypt with KMS
- Encryption chosen at creation time
Databases
- RDS encryption set at creation
- Restore a snapshot to encrypt later
- DynamoDB is always encrypted at rest
- Client-side SDK for field encryption
Messaging and streams
- SQS and SNS server-side encryption
- Kinesis encrypts with KMS keys
- Secrets Manager encrypts secret values
- Parameter Store SecureString uses KMS
Secrets Manager against Parameter Store
- Secrets Manager
- rotation built in, priced per secret
- Parameter Store
- free standard tier, no rotation
- SecureString
- KMS encrypted parameter value
- Rotation function
- must reach the database privately
- Cross-account use
- resource policy on the secret
- Replication
- secret copies in other Regions
- Never in code
- no secrets in environment variables
- Retrieval
- fetch at runtime, cache briefly
Classification and discovery
- Macie finds regulated data in S3
- Custom identifiers use regular expressions
- Tag buckets by sensitivity tier
- Classification drives encryption and retention
- Automated discovery samples buckets continuously
- Scope discovery jobs to control cost
Certificates and data in transit
- ACM issues and renews public certificates
- Private CA serves internal hostnames
- Deny requests when aws:SecureTransport is false
- TLS usually terminates at the balancer
- Mutual TLS available on API Gateway
- OCSP gives fresher revocation than lists
Backup and immutability
- AWS Backup centralizes plans and vaults
- Vault Lock resists deletion by administrators
- Cross-account copies survive account compromise
- Cross-Region copies need a destination key
- MFA Delete on versioned buckets
- Restore testing proves the backup works
Data perimeter controls
- RCP denies untrusted principals organization wide
- SCP blocks disabling default encryption
- Endpoint policy limits which identities call
- s3:ResourceAccount pins trusted account ids
- aws:PrincipalOrgID keeps access internal
- Deny public snapshot and AMI sharing
Data protection failures
- Bucket left public through an old ACL
- Customer supplied key lost, objects unreadable
- Snapshot shared publicly by mistake
- Key deleted and ciphertext gone with it
- Secrets baked into container images
- Cross-Region copy lands outside residency
Rapid recall: pick the protection
- Provider must not read
- client-side encryption
- Auditable key usage
- customer managed KMS key
- Single tenant hardware
- AWS CloudHSM
- Undeletable for seven years
- Object Lock compliance mode
- Automatic credential rotation
- AWS Secrets Manager
- Cheap configuration values
- Parameter Store standard tier
- Find card numbers
- Amazon Macie
- One key, two Regions
- KMS multi-Region key
Reference strip: custody, at rest, in transit, secrets, durability
Key custody
- AWS owned, AWS managed, customer managed
- Imported material for your own key
- CloudHSM backed custom key store
- Grants for temporary delegation
At rest
- EBS, S3, RDS and DynamoDB
- Default encryption per account
- Envelope encryption everywhere
- Bucket Keys reduce KMS calls
In transit
- TLS enforced by policy condition
- ACM public and private certificates
- Mutual TLS at the API
- VPC endpoints keep traffic internal
Secrets
- Secrets Manager rotates credentials
- Parameter Store for configuration
- Never in code or environment
- Resource policy for cross-account
Durability
- Versioning plus MFA Delete
- Object Lock and Vault Lock
- Cross-account backup copies
- Restore testing on a schedule
Quick exam traps
- Trap: Enabling KMS key rotation makes older ciphertext undecryptable
- Trap: An IAM policy on its own can grant use of a KMS key
- Trap: S3 Bucket Keys remove the need for key policy permissions
- Trap: Encryption can be switched on for a running RDS instance
- Trap: Bucket level Block Public Access overrides the account setting
- Trap: A presigned URL stays valid for its full expiry no matter who signed it
- Trap: Deleting a KMS key can be undone after the waiting period ends
- Trap: Copying an encrypted snapshot to another Region keeps the source key
cybercertprep.com · original revision sheet written from the public body of knowledge