Data protection

Key points

• Key policy: every KMS key has exactly one, and it is the primary access control. IAM policies can allow use of a key only if the key policy enables them.
• Envelope encryption: Encrypt takes at most 4,096 bytes. For larger data, GenerateDataKey returns a data key that encrypts locally, and KMS protects the data key.
• Rotation: optional for customer managed keys, every 90 to 2,560 days (default 365), plus on-demand rotation. AWS managed keys rotate every year. Old key material stays available to decrypt.
• Multi-Region keys: related keys with the same key ID and key material in several Regions, so data encrypted in one Region decrypts in another without a cross-Region call.
• Sharing: resources encrypted under an AWS managed key cannot be shared with other accounts. Use a customer managed key whose key policy allows the other account.

Key points

• Single tenant: dedicated HSMs, FIPS 140-2 or FIPS 140-3 Level 3 validated for clusters in FIPS mode.
• Full control: you manage HSM users and keys, and the end-to-end encrypted data plane is not visible to AWS.
• Standard interfaces: PKCS #11, JCE, CNG and KSP ease the migration of existing PKI and cryptographic workloads.
• KMS custom key store: a CloudHSM key store keeps KMS integration while key material stays in your cluster, for low request rate workloads.
• Trade-off: more operational responsibility than KMS, including availability and scaling of the cluster.

Key points

• SSE-S3: the default for new uploads since January 5, 2023. AES-256 with keys that S3 manages, at no additional cost.
• SSE-KMS: KMS keys with key policies and CloudTrail records of key use. S3 Bucket Keys reduce KMS request costs by up to 99%.
• DSSE-KMS: 2 independent layers of AES-256 encryption for multilayer compliance. S3 Bucket Keys are not supported.
• SSE-C: you send the key with every request over HTTPS and S3 never stores it. Since April 2026 it is disabled by default on new buckets and must be enabled explicitly.
• Client-side encryption: data is encrypted before upload, so it reaches S3 already encrypted.

Key points

• Integrated services: Elastic Load Balancing, CloudFront, API Gateway, App Runner, Amplify, Elastic Beanstalk and Network Firewall TLS inspection.
• CloudFront rule: the certificate must be requested or imported in US East (N. Virginia), us-east-1.
• Regional: certificates cannot be copied between Regions. Request one in each Region where a load balancer uses it.
• Managed renewal: automatic for DNS-validated certificates in use. Imported certificates are not renewed by ACM, so track their expiry.
• On EC2: use the ACME protocol for publicly trusted certificates on your own servers. An ACM-managed certificate on an instance requires Nitro Enclaves.

Key points

• Secrets Manager: KMS-encrypted secrets with automatic rotation, either managed rotation or a Lambda rotation function, with native database integrations.
• Replication: replica secrets in other Regions, and rotation of the primary secret propagates to them.
• Parameter Store: String, StringList and SecureString (KMS-encrypted) parameters in hierarchies, with no credential rotation.
• Tiers: standard is free, with 10,000 parameters of up to 4 KB. Advanced allows 100,000 parameters of up to 8 KB, parameter policies and cross-account sharing, for a charge.
• Cost: Secrets Manager bills per secret per month and per API call.

Key points

• GuardDuty: threat detection from CloudTrail management events, VPC Flow Logs and DNS logs, without enabling those logs yourself. Protection plans add S3, EKS, runtime, malware, RDS and Lambda.
• Inspector: continuous scanning of EC2 instances, ECR container images and Lambda functions for software vulnerabilities and unintended network exposure.
• Macie: discovers sensitive data such as PII in S3 with machine learning and pattern matching, and flags bucket issues such as public access.
• Security Hub CSPM: checks accounts against standards such as AWS Foundational Security Best Practices and CIS, and aggregates findings from GuardDuty, Inspector and Macie. Most controls need AWS Config.
• Detective: builds a behavior graph from CloudTrail, VPC Flow Logs and GuardDuty findings to investigate the root cause.

Key points

• S3 Object Lock: write once, read many per object version, and it requires versioning. Use retention periods, or legal holds that have no expiry and stay until removed.
• Governance mode: users with s3:BypassGovernanceRetention can override the lock. Useful to test retention settings.
• Compliance mode: no user, not even the root user, can delete the version or shorten its retention until it expires.
• Glacier Vault Lock: a vault lock policy that becomes unchangeable once you complete the lock within 24 hours. The original vault service no longer accepts new customers, so new designs use Object Lock with S3 Glacier storage classes.
• AWS Backup Vault Lock: governance or compliance mode for backup vaults. In compliance mode the vault becomes immutable after a grace time of at least 72 hours.

Key points

• Reports: download SOC reports, ISO certifications and PCI DSS documents that show auditors the controls AWS operates.
• Agreements: review, accept and track agreements with AWS for one account or for every account of the organization.
• Shared responsibility: Artifact covers the compliance of AWS. You still document the compliance of your own workloads.
• Marketplace vendors: security and compliance documents of ISVs that sell on AWS Marketplace are also available.