1. Home
  2. Training Library
  3. Amazon Web Services
  4. Courses
  5. Understanding S3 encryption mechanisms to secure your data

Overview of Encryption Mechanisms

The course is part of these learning paths

Solutions Architect – Professional Certification Preparation for AWS
course-steps 47 certification 6 lab-steps 19 quiz-steps 4 description 2
SysOps Administrator – Associate Certification Preparation for AWS
course-steps 35 certification 5 lab-steps 30 quiz-steps 4 description 5
Certified Developer – Associate Certification Preparation for AWS
course-steps 29 certification 5 lab-steps 22 description 2
Security - Specialty Certification Preparation for AWS
course-steps 22 certification 2 lab-steps 12 quiz-steps 5
AWS Access & Key Management Security
course-steps 6 certification 2 lab-steps 2 quiz-steps 2
more_horiz See 2 more
play-arrow
Overview of Encryption Mechanisms
Overview
Transcript
DifficultyAdvanced
Duration12m
Students1376
Ratings
4.9/5
star star star star star-half

Description

Course Description

We have all seen in the media numerous occurrences whereby large international organizations have had their data exposed and leaked that had been stored on S3.  Any sensitive data stored in the cloud MUST be encrypted, and when storing your data on S3 there are multiple different options that you can choose from to enable you to protect your data with encryption.  To help you understand these mechanisms, this course will guide you through the process of how each of them works, not just from an encryption perspective but also at a decryption level.  This will allow you to make the right choice when it comes to selecting the most appropriate method of encryption to align with your own internal security strategy.

Applying encryption is a simple task and it can protect you and your customers from data exposure should a malicious user gain access to your S3 buckets.

Learning Objectives

By the end of this course series you will be able to explain the encryption and decryption process for:

  • Server-Side Encryption with S3 Managed Keys (SSE-S3)
  • Server-Side Encryption with KMS Managed Keys (SSE-KMS)
  • Server-Side Encryption with Customer Provided Keys (SSE-C)
  • Client-Side Encryption with KMS Managed Keys (CSE-KMS)
  • Client-Side Encryption with Customer Provided Keys (CSE-C)

Intended Audience

This course is intended for those who have a responsibility of storing, managing and protecting data that is stored on Amazon S3.  

Prerequisites

This is an advanced level course and so it is essential that you have an understanding of S3 and that you have the knowledge to enable you to upload and retrieve data along with how to select different encryption options.

In addition to this, you must also be familiar with the KMS service and understand both CMKs and Data encryption keys.  

This course includes

7 lectures

Feedback

If you have thoughts or suggestions for this course, please contact Cloud Academy at support@cloudacademy.com.

About the Author

Students55517
Labs1
Courses55
Learning paths36

Stuart has been working within the IT industry for two decades covering a huge range of topic areas and technologies, from data centre and network infrastructure design, to cloud architecture and implementation.

To date, Stuart has created 50+ courses relating to Cloud, most within the AWS category with a heavy focus on security and compliance

He is AWS certified and accredited in addition to being a published author covering topics across the AWS landscape.

In January 2016 Stuart was awarded ‘Expert of the Year Award 2015’ from Experts Exchange for his knowledge share within cloud services to the community.

Stuart enjoys writing about cloud technologies and you will find many of his articles within our blog pages.

Transcript

Depending on your requirements, one method of encryption may be more appropriate than another. To help you decide, here is a quick overview of each. 

Server-side encryption with S3 managed keys, SSE-S3. This option requires minimal configuration and all management of encryption keys used are managed by AWS. All you need to do is to upload your data and S3 will handle all other aspects. 

Server-side encryption with KMS managed keys, SSE-KMS. This method allows S3 to use the key management service to generate your data encryption keys. KMS gives you a far greater flexibility of how your keys are managed. For example, you are able to disable, rotate, and apply access controls to the CMK, and order to against their usage using AWS Cloud Trail. 

Server-side encryption with customer provided keys, SSE-C. This option gives you the opportunity to provide your own master key that you may already be using outside of AWS. Your customer-provided key would then be sent with your data to S3, where S3 would then perform the encryption for you. 

Client-side encryption with KMS, CSE-KMS. Similarly to SSE-KMS, this also uses the key management service to generate your data encryption keys. However, this time KMS is called upon via the client not S3. The encryption then takes place client-side and the encrypted data is then sent to S3 to be stored. 

Client-side encryption with customer provided keys, CSE-C. Using this mechanism, you are able to utilize your own provided keys and use an AWS-SDK client to encrypt your data before sending it to S3 for storage. 

Okay, that has given us a very high-level overview of the five different methods. Via a series of diagrams, I will now explain how the encryption and decryption process works for each.