Amazon S3 Encryption
Amazon Elastic File System
AWS Storage Gateway
The course is part of this learning path
This course covers the core learning objective to meet the requirements of the 'Designing storage solutions in AWS - Level 3' skill
- Evaluate the different Amazon S2 encryption meachanisms available for both client and serfver cryptographic operations
- Create a file storage strategy for complex organizations
- Analyze the differenr AWS storage services available to implement a hybid storage solution based upon different data set sizes, business requirements, and cost optimization
Client-Side Encryption with KMS Managed Keys, CSE-KMS. The encryption process is as follows. Using an AWS SDK, such as the Java client, a request is made to KMS for Data Keys that are generated from a specific CMK. This CMK is defined by providing the CMK-ID in the request. KMS will then generate two Data Keys from the specified CMK. One key will be a Plaintext Data Key. The second will be a Cipher blob of the same Data Key. Both keys are then sent back to the client. The client will then combine the Object Data with the Plaintext Data Key to create an encrypted version of the Object Data. The client then uploads both the encrypted Object Data and the Cipher blob version of the Data Key to S3. S3 will then store the encrypted Object Data and associate the Cipher blob Data Key as Metadata of the encrypted Object Data. The decryption process is as follows. A request is made by the client to S3 to retrieve the Object Data. S3 sends both the encrypted Object Data and the Cipher blob back to the client. Using an AWS SDK, such as the Java client, the Cipher blob Data Key is sent to KMS. KMS combines the Cipher blob Data Key with the corresponding CMK to produce the Plaintext Data Key. This Plaintext Data Key is then sent back to the client and the Plaintext Data Key is then used to decrypt the encrypted Object Data.
Stuart has been working within the IT industry for two decades covering a huge range of topic areas and technologies, from data center and network infrastructure design, to cloud architecture and implementation.
To date, Stuart has created 150+ courses relating to Cloud reaching over 180,000 students, mostly within the AWS category and with a heavy focus on security and compliance.
Stuart is a member of the AWS Community Builders Program for his contributions towards AWS.
He is AWS certified and accredited in addition to being a published author covering topics across the AWS landscape.
In January 2016 Stuart was awarded ‘Expert of the Year Award 2015’ from Experts Exchange for his knowledge share within cloud services to the community.
Stuart enjoys writing about cloud technologies and you will find many of his articles within our blog pages.