2.2.1 Encryption at Rest and in Transit

Encryption at Rest and in Transit

At Rest

ServiceDefault EncryptionOptions
S3SSE-S3 (default since 2023)SSE-S3, SSE-KMS, SSE-C, Client-side
DynamoDBAWS owned key (default)AWS owned, AWS managed, CMK
EBSOptional (can enforce via SCP)AWS managed, CMK
RDSOptionalAWS managed, CMK
Lambda env varsAWS managed keyCMK (encryption helpers)
EFSEncryption at rest (KMS), in transit (TLS)AWS managed, CMK

EBS Encryption

  • Encrypt volumes, snapshots, và AMIs
  • AES-256 encryption
  • Minimal impact on latency
  • Snapshots of encrypted volumes = encrypted
  • Copy unencrypted snapshot → can encrypt during copy
# Enable default encryption cho region
aws ec2 enable-ebs-encryption-by-default

# Create encrypted volume
aws ec2 create-volume --encrypted --kms-key-id alias/my-key \
  --availability-zone us-east-1a --size 100 --volume-type gp3

S3 Encryption Types

TypeKey ManagementAudit TrailUse Case
SSE-S3AWS manages entirelyDefault, simple
SSE-KMSKMS manages✅ CloudTrailAudit, compliance
SSE-CCustomer provides key per requestFull key control
Client-sideApplication encrypts before uploadEnd-to-end encryption

In Transit

  • TLS/SSL cho tất cả AWS API endpoints
  • HTTPS enforced qua S3 bucket policy:
{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": "arn:aws:s3:::my-bucket/*",
  "Condition": {
    "Bool": {"aws:SecureTransport": "false"}
  }
}
  • VPN / Direct Connect cho private connectivity
  • ACM (Certificate Manager) cho SSL/TLS certificates

Client-side vs Server-side

Server-side (SSE)Client-side
Encrypt byAWS serviceApplication
Key managementAWS/KMS/CustomerApplication
Data in transitPlaintext → AWS → EncryptEncrypted → AWS
Use caseMost workloadsStrict compliance

Exam Tip: SSE-S3 = default, simplest. SSE-KMS = audit trail + key control. SSE-C = customer manages keys. Enforce HTTPS = aws:SecureTransport condition.