Encryption on AWS

Symmetric encryption — the same secret protecting and revealing a message — is old. The Spartan scytale, a rod of a particular diameter around which a strip of leather was wrapped before the message was written across it, is a working example from around 700 BC, and it already showed the property that still defines the field: the security rests entirely on controlling the key, not on concealing the method. Every service below exists to solve that one problem at scale.

Two states to protect

Encryption at rest

Data in storage. On AWS this is supported natively across the storage and database services:

• Amazon EBS volumes and snapshots
• Amazon S3 objects
• Amazon RDS and Amazon Aurora databases
• Amazon DynamoDB tables
• Amazon SQS queues and Amazon SNS topics
• Amazon EFS and Amazon FSx file systems

In almost all cases this is a matter of selecting a key rather than implementing anything — an AWS owned key by default, or a customer managed KMS key where audit and control are required.

Encryption in transit

Data moving between systems:

• TLS for HTTPS traffic, terminated at CloudFront, a load balancer or the application
• IPsec for site-to-site VPN connections
• TLS between application components, including between a service and its database

AWS Key Management Service (KMS)

KMS creates and controls the keys that protect data at rest.

• Centralised creation, storage and lifecycle management of KMS keys
• Native integration with most AWS services — S3, EBS, RDS, DynamoDB, Lambda, Secrets Manager and others
• Key material generated by AWS KMS, imported by the customer, or held in a custom key store
• Fine-grained access control through key policies, IAM policies and grants
• Every use of a key is recorded in AWS CloudTrail
• Multi-tenant and highly available, with no infrastructure to run

Validation and compliance. AWS KMS uses hardware security modules validated under FIPS 140-3 Security Level 3, deployed in every Region where KMS is offered. All KMS keys are protected by those HSMs regardless of when they were created. KMS is in scope for PCI DSS Level 1 and the other AWS compliance programmes.

For key ownership classes, key material origin, rotation rules and access control, see KMS vs CloudHSM.

AWS CloudHSM

CloudHSM provides dedicated, single-tenant hardware security modules inside your VPC.

• Current instance type: hsm2m.medium, standards-compliant, single-tenant and FIPS 140-3 Level 3 certified
• Billed hourly per provisioned HSM, with no upfront payment and no reserved pricing
• Clustered by default across Availability Zones for durability and availability
• Requires VPC deployment and application integration through PKCS #11, JCE, CNG or OpenSSL
• You administer HSM users, groups and quorum policies, and you are responsible for generating, backing up and rotating key material

Typical uses: SSL/TLS offload onto dedicated hardware, running a private certificate authority, Oracle Transparent Data Encryption with customer-held keys, and any requirement for sole control of key material.

Older material describes a “CloudHSM Classic” based on SafeNet Luna appliances with a large upfront charge and manual high-availability setup. That service is long gone, and so is its successor instance type hsm1.medium; existing clusters were migrated to hsm2m.medium.

AWS Certificate Manager (ACM)

ACM issues, stores and renews the TLS certificates that protect data in transit.

• Public certificates are issued at no charge for use with integrated AWS services
• Integrates with Amazon CloudFront, Elastic Load Balancing, API Gateway and others
• Wildcard certificates cover subdomains — one certificate for *.example.com
• Automatic renewal for certificates that ACM issued and that remain in use, which removes the single most common cause of an avoidable outage
• Third-party certificates can be imported, but imported certificates are not renewed automatically

Certificate types

1. Public certificates — issued by Amazon’s public certificate authority, validated by DNS or email, free, renewed automatically.
2. Private certificates — issued by AWS Private Certificate Authority for internal services, mutual TLS between components, and devices. This is a paid service and gives full control over the certificate hierarchy.

Validation is by DNS record or by email to the domain contacts. DNS validation is the one to choose: it is the only method that allows renewal to happen without human involvement.