Encryption at rest and in transit: SAA-C03 study notes and practice questions
What to know about Encryption at rest and in transit for the SAA-C03 exam, from the Design Secure Architectures domain (30% of the exam guide), then 2 free questions to test it. Part of the SAA-C03 study guide.
Encryption questions test two things: who controls the key, and how to get encryption onto data that may not have it yet.
AWS KMS
AWS managed keys (named aws/service) are created for you, rotate every year, and can’t have a custom key policy.
Customer managed keys are yours: you write the key policy, choose rotation (yearly by default when turned on, or a custom period), and can disable or schedule deletion. Use them for separation of duties, cross-account use or audit requirements.
Envelope encryption: KMS keys encrypt small data keys, and the data keys encrypt your data. That’s why KMS can protect large objects and volumes.
Multi-Region keys share key material across Regions, so data encrypted in one Region can be decrypted in another without re-encrypting.
Imported key material or an external key store is for rules that say the key material must come from (or stay in) your own hardware.
AWS CloudHSM gives single-tenant HSMs that you manage, for FIPS 140-3 Level 3 requirements or when you must control the HSM yourself.
Encrypting what already exists
Resource
How
EBS volume
You can’t encrypt in place. Snapshot it, copy the snapshot with encryption, and create a new volume. Turn on EBS encryption by default per Region so new volumes are always encrypted.
RDS instance
You can’t encrypt in place. Snapshot, copy the snapshot with encryption, restore. Read replicas share the source’s encryption.
S3 objects
New objects are already encrypted (SSE-S3). To change existing objects to SSE-KMS, copy them in place, for example with S3 Batch Operations.
DynamoDB
Always encrypted at rest; you can switch between key types at any time.
In transit
AWS Certificate Manager (ACM) issues public TLS certificates at no extra charge for integrated services (load balancers, CloudFront, API Gateway) and renews them automatically. CloudFront certificates must be in us-east-1.
Terminate TLS on the load balancer for simplicity; use end-to-end TLS to the targets when the scenario requires encryption all the way to the instance.
Common traps
Expecting to “turn on” encryption for an existing EBS volume or RDS instance. Both need a snapshot copy.
Choosing CloudHSM for ordinary key control. A customer managed KMS key is enough unless dedicated hardware is required.
Requesting a CloudFront certificate in another Region. It must be in us-east-1.
A small charity's donation website runs on Amazon EC2 instances behind an Application Load Balancer and is served over HTTP only.
Browsers now warn visitors that the site is not secure. The charity needs HTTPS with a certificate that browsers trust, it has no one to renew certificates by hand, and it cannot pay for anything extra.
What should a solutions architect do?
Choose one answer.
AA. Buy a certificate from a commercial certificate authority, import it into AWS Certificate Manager, and attach it to a new HTTPS listener.
BB. Request a public certificate in AWS Certificate Manager with DNS validation, and attach it to a new HTTPS listener on the load balancer.
CC. Issue a private certificate from AWS Private CA through AWS Certificate Manager, and attach it to a new HTTPS listener on the load balancer.
DD. Generate a self-signed certificate with OpenSSL on one instance, upload it to IAM, and attach it to a new HTTPS listener on the load balancer.
C. Wrong: Private certificates are not publicly trusted, so visitors' browsers would still show warnings, and AWS Private CA has its own charges. Private certificates are meant for internal traffic. A public ACM certificate fits a public website. Learn more: Types of certificates in AWS Certificate Manager (opens in a new tab)
D. Wrong: A self-signed certificate is free, but no browser trusts it, so visitors would see a security warning. It also has to be replaced by hand before it expires. A public ACM certificate is trusted and renews itself. Learn more: What is AWS Certificate Manager? (opens in a new tab)
Explanation
AWS Certificate Manager issues public TLS certificates at no extra charge for use with integrated services such as Elastic Load Balancing and CloudFront. They are trusted by browsers, and DNS-validated certificates in use are renewed automatically. Imported certificates are not renewed by ACM, and private or self-signed certificates are not publicly trusted.
A company's security policy says that every Amazon EBS volume created from now on must be encrypted with one of the company's own AWS KMS customer managed keys.
Developers create volumes by hand in the console, and Auto Scaling groups launch instances from many older AMIs and launch templates that do not set encryption. The company uses two AWS Regions.
Which solution meets the policy with the LEAST operational effort?
Choose one answer.
AA. Update every launch template and AMI block device mapping to set encryption with the customer managed key, and publish a guide for developers.
BB. Deploy the AWS Config encrypted-volumes rule in both Regions, with automatic remediation that replaces unencrypted volumes with encrypted copies.
CC. Turn on EBS encryption by default in both Regions, and set a customer managed key in each Region as the default KMS key.
DD. Use AWS Systems Manager State Manager to install and configure an operating system disk encryption tool on every EC2 instance in both Regions.
Show the answer and explanation
Answer: C
A. Wrong: This covers the Auto Scaling groups only after a lot of editing, and relies on developers remembering to encrypt volumes they make by hand. Any template or volume that is missed breaks the policy. Encryption by default enforces it for every new volume. Learn more: Amazon EBS encryption (opens in a new tab)
B. Wrong: The rule only flags volumes after they exist. EBS cannot encrypt a volume in place, so remediation has to snapshot, copy and swap volumes, which is complex and disruptive. Encryption by default stops unencrypted volumes from being created. Learn more: encrypted-volumes (AWS Config rule) (opens in a new tab)
C. Right: Correct. Encryption by default is a per-Region setting. Once it is on, every new volume, including those created at instance launch, is encrypted, and you can choose a customer managed key in place of aws/ebs. Learn more: Enable Amazon EBS encryption by default (opens in a new tab)
D. Wrong: Operating system encryption protects data inside the guest, but the EBS volumes themselves are not encrypted with the company's KMS key. It also adds an agent and configuration to manage on every instance. EBS encryption by default is a single setting per Region. Learn more: AWS Systems Manager State Manager (opens in a new tab)
Explanation
EBS encryption by default is set once per Region and applies to every new volume, whether created by hand or at instance launch from an AMI or launch template. You can make a customer managed KMS key the default. It does not change existing volumes, which is fine here because the policy is for new volumes.
Want more on Encryption at rest and in transit? The 5 full-length practice sets have 11 more Encryption at rest and in transit questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →