Encryption modes and enforcing transit
1. Encryption modes and enforcing transit
Chapter two was about the caller. Chapter three is about the data itself, and the evidence you leave behind. Start with a surprise: every new object you put in S3 is already encrypted. So what is left to decide?2. Two guarantees, one default
Encryption gives you two separate guarantees. At rest protects the bytes on disk. In transit protects them on the network, while they move. Different threats, different controls.3. Two guarantees, one default
Since January 2023, S3 encrypts every new object automatically with SSE-S3, a key AWS manages at no cost. Nobody switches that on. So asking whether an object is encrypted tells you almost nothing. Which mode, and who holds the key, do.4. Where the plaintext ends
Before the modes, one boundary decides everything: where your data stops being readable. Server-side means you send readable bytes to AWS, and S3 encrypts them as it writes.5. Where the plaintext ends
Client-side means you encrypt inside your own process, so AWS receives only ciphertext. It is the difference between handing over a sealed box and one the courier seals for you. You keep the key, and the work.6. Four modes, one difference
Stay server-side and S3 gives you four modes, all AES-256, differing only on who controls the key. They all start with SSE, server-side encryption. SSE-S3 uses a key AWS manages, with nothing to configure. SSE-KMS uses a key you own in Key Management Service, KMS, which buys a key policy and a CloudTrail entry per use.7. Four modes, one difference
DSSE-KMS applies two independent layers of AES-256, for compliance regimes that demand it. SSE-C means you send your own key with every request. AWS never stores it, so losing the key loses the object.8. The cost objection to SSE-KMS
The usual objection to SSE-KMS is cost: without Bucket Keys, every read and write calls KMS and you pay per request. Bucket Keys let S3 derive object keys from one short-lived bucket-level key, cutting those calls by up to ninety-nine percent.9. Encrypt the field, not the table
The same defaults hold beyond S3. DynamoDB encrypts every table at rest with nothing to enable. So why encrypt again in your code? Because that ends once someone with read access queries the table: a locked cabinet does not help when you are in the room.10. Encrypt the field, not the table
The AWS Database Encryption SDK encrypts chosen attributes before the item is written, so a national identity number stays ciphertext even to an engineer running a query. Partition and sort keys stay readable: DynamoDB indexes on them.11. TLS is offered, not required
Now the second guarantee. Every S3 endpoint offers HTTPS, HTTP over Transport Layer Security, so transit feels solved. But offering is not requiring. A client connecting over plain HTTP is served the same.12. TLS is offered, not required
Closing that path takes one statement in the bucket policy: deny every request where aws:SecureTransport is false. That is a lock on the door, not a sign asking people to close it. Your HTTPS clients notice nothing.13. Which authority vouches for the name
That HTTPS depends on a certificate from an authority the client already trusts. AWS Certificate Manager, ACM, issues publicly trusted certificates free, and renews them. But no public authority can validate a name that only resolves inside your own network, your VPC. AWS Private CA is your authority for those.14. The private half is yours to lose
Certificates are public; private keys are not. ACM generates and holds yours, and renews the certificate before it expires, so you store and replace nothing. An EC2 key pair is the opposite: AWS hands you the private half once, with no copy to recover.15. The private half is yours to lose
The half you hold is the half you can lose. It belongs in Secrets Manager, not a repo, a laptop, or chat. And it will not renew itself: replace it on a schedule, and when someone who had a copy leaves.16. Three answers, not one
Back to the bucket. Encrypted is three answers, not one. Which mode is in use. Who controls the key, remembering that a key policy can name a principal in another account. And whether transit is required or only offered. Ask all three next time you review a bucket.17. Let's practice!
Let's practice with encryption modes and enforcing transit.Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.