Encryption and Secrets

Two separate problems live in this section, and they are easy to conflate. Key management is about the cryptographic material that protects data at rest and in transit. Secret management is about the credentials an application needs at runtime — database passwords, API keys, tokens.

Keys. AWS KMS is the default: a managed, multi-tenant key service integrated with almost every AWS service, with key policies, grants, CloudTrail auditing and optional automatic rotation. AWS CloudHSM is the answer when a single-tenant, customer-controlled HSM is a hard requirement — a regulator demands sole control of the key material, or an application needs PKCS #11, JCE or CNG directly. AWS Certificate Manager issues and renews the TLS certificates that protect data in transit.

Secrets. AWS Secrets Manager stores and rotates credentials, and for several AWS databases it rotates them without any code of yours. Systems Manager Parameter Store stores configuration data hierarchically, encrypts SecureString values with KMS, and has a free tier — but it does not rotate anything. The comparison page sets out when each is the right choice.

Start with History and modern implementation of encryption in AWS for the at-rest / in-transit split and how KMS, CloudHSM and ACM divide the work.