Encryption with KMS and securing S3
Questions about protecting data at rest and in transit appear in every version of the exam. The answers are usually a specific KMS or S3 feature, so the details matter.
AWS KMS keys
AWS Key Management Service stores and uses keys without exposing them.
| Key type | Who manages | Rotation |
|---|---|---|
| AWS owned key | AWS, invisible to you | AWS decides |
AWS managed key (aws/s3) | AWS, in your account | Automatic |
| Customer managed key | You | Optional automatic rotation, or manual |
| Imported key material | You | Manual only |
A key policy is always the starting point for access. Even with an IAM Allow, the caller fails unless the key policy permits the account or the principal. Use multi-Region keys when data encrypted in one Region must be decrypted in another. For keys you must control in dedicated hardware, use AWS CloudHSM.
S3 encryption choices
All new S3 objects are encrypted by default with SSE-S3. Your options are:
- SSE-S3: AWS manages the keys, no extra setup.
- SSE-KMS: uses a KMS key, gives audit trails in CloudTrail and per-key permissions.
- DSSE-KMS: two layers of encryption.
- SSE-C: you send the key with every request.
- Client-side: you encrypt before upload.
Heavy SSE-KMS traffic can hit KMS request quotas; S3 Bucket Keys reduce those calls and cost.
Encryption in transit
Use HTTPS/TLS. Put certificates from AWS Certificate Manager on an Application Load Balancer, CloudFront or API Gateway. Enforce TLS on a bucket with a policy condition on aws:SecureTransport. To redirect HTTP to HTTPS on an ALB, add a listener rule on port 80 that returns a redirect action.
Locking down S3
- Block Public Access at the account or bucket level overrides public ACLs and policies.
- Versioning plus MFA Delete protects against accidental deletes.
- S3 Object Lock gives WORM storage. Governance mode can be bypassed with special permission; compliance mode cannot. A legal hold has no end date.
- VPC endpoints: a gateway endpoint for S3 and DynamoDB is free; interface endpoints (AWS PrivateLink) cost money but work from on premises.
- Presigned URLs give temporary access to one object.
Secrets
Use AWS Secrets Manager for database credentials that need automatic rotation. Systems Manager Parameter Store is cheaper for plain configuration, with SecureString for secrets.
Exam traps
- Versioning alone does not make data immutable; Object Lock does.
- Governance mode can be overridden, compliance mode cannot, not even by root.
- Disabling a key is not the same as deleting it; deletion has a 7 to 30 day waiting period.
- Gateway endpoints work only for S3 and DynamoDB; everything else uses interface endpoints.
- A bucket policy alone does not help a user whose KMS permission is missing.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A company needs encryption keys that rotate every year automatically with the least effort, and S3 data must be encrypted at rest. What should they use?
Show answer
Answer: A.SSE-KMS with a customer managed key supports automatic rotation, and SSE-S3 keys are managed and rotated by AWS.
2. Regulations say uploaded records must not be changed or deleted for seven years, even by the account administrator. Which S3 feature fits?
Show answer
Answer: B.Object Lock in compliance mode prevents any user, including root, from overwriting or deleting the object version during the retention period.
3. Traffic from private EC2 instances to S3 must not cross the internet and should be restricted to the company bucket. What is the simplest design?
Show answer
Answer: B.A gateway endpoint for S3 is free, keeps traffic on the AWS network, and an endpoint policy can limit which buckets are reachable.
4. A Lambda function reads an encrypted environment variable. Which permissions allow it to decrypt the value?
Show answer
Answer: A.KMS access needs permission on the identity side (execution role) and on the key policy side.