Data security controls

Classify data, encrypt it at rest and in transit with keys you control at the right level, decide who can use those keys, and keep recoverable, tamper-resistant copies for as long as the rules require.

Encryption at rest and AWS KMS

• AWS KMS keys: AWS owned keys (invisible to you), AWS managed keys (aws/s3, aws/ebs; created and rotated for you), and customer managed keys (you control the key policy, rotation, disabling, and cross-account use).
• Envelope encryption: KMS encrypts small data keys; the service encrypts your data with the data key. Large data never travels to KMS.
• Key policies: Every KMS key has one, and it is the primary control. IAM policies only work for a key if its key policy allows the account to use IAM. Grants give temporary, narrow use.
• Cross-account and multi-Region: Share a customer managed key with another account through its key policy. Multi-Region keys have the same key material in several Regions for data that is replicated.
• AWS CloudHSM: Dedicated, single-tenant hardware security modules in your VPC where you alone manage the keys. Choose it when rules require exclusive control of the HSM.
• Every KMS key use is logged in CloudTrail, which gives an audit trail of who decrypted what.

Encrypting data in Amazon S3

• SSE-S3: Keys managed by S3. Applied by default to every new object.
• SSE-KMS: Uses a KMS key, adding key-policy control and CloudTrail records of key use. S3 Bucket Keys cut the number of KMS requests and their cost.
• DSSE-KMS: Two independent layers of server-side encryption, for rules that require dual-layer encryption.
• SSE-C and client-side encryption: You supply the key with each request (SSE-C), or you encrypt before upload so AWS never sees plaintext (client-side).
• Enforce choices with a bucket policy: deny requests where aws:SecureTransport is false, or deny uploads that don't use the required KMS key.

Encryption in transit and certificates

• AWS Certificate Manager (ACM): Issues public TLS certificates for integrated services such as Elastic Load Balancing, CloudFront, and API Gateway, and renews DNS-validated certificates automatically.
• Certificates you import into ACM are not renewed by ACM. Watch their expiry (ACM and AWS Config can alert) and re-import before they lapse.
• AWS Private CA: A managed private certificate authority for internal TLS, such as service-to-service traffic.
• Require TLS end to end where needed: HTTPS-only viewer policy on CloudFront, HTTPS listeners on load balancers, and TLS-required settings on databases.

Access, governance, classification, and retention

• S3 Block Public Access: On by default for new buckets; keep it on at the account level unless a bucket must be public.
• S3 Object Ownership: "Bucket owner enforced" (the default for new buckets) disables ACLs, so policies alone control access.
• S3 Versioning and MFA Delete: Keep prior versions so overwrites and deletes can be undone; MFA Delete adds a second factor for permanent deletes.
• S3 Object Lock: Write-once-read-many retention. Governance mode can be overridden by users with special permission; compliance mode can't be shortened or removed by anyone, including root. Legal holds have no end date.
• Lifecycle and retention: Lifecycle rules expire objects when the retention period ends, so data isn't kept (and paid for) longer than policy allows.
• Classify first: Macie finds sensitive data in S3, and tags record the classification so policies and lifecycle rules can act on it.
• AWS Config rules check resources against compliance requirements continuously; AWS Artifact provides AWS's own audit reports.

Backups, replication, and recovery

• AWS Backup: Central backup plans for EBS, RDS, Aurora, DynamoDB, EFS, FSx, S3, and more, with cross-Region and cross-account copies. AWS Backup Vault Lock makes backups immutable.
• S3 Replication: Cross-Region (CRR) or same-Region (SRR) copies of new objects (S3 Batch Replication copies existing ones). Requires versioning on both buckets; KMS-encrypted objects need the replication role to use both keys.
• Database recovery: RDS and Aurora automated backups give point-in-time recovery; DynamoDB has point-in-time recovery and on-demand backups.
• Keep backup copies in a separate account to protect them from a compromised or mistaken production account.

Rotating keys and renewing certificates

• Turn on automatic rotation for customer managed KMS keys. KMS keeps old key material, so data encrypted earlier still decrypts with no re-encryption.
• Keys with imported key material can't use automatic rotation, but since June 2025 they support on-demand rotation: import new key material into the same key, then rotate. The key ID, ARN, and alias stay the same, and data encrypted under the older material still decrypts.
• Secrets Manager rotates database credentials on a schedule and updates the secret, so applications that read the secret pick up the new password.