1. Home
  2. Training Library
  3. Encryption (SAA-C02)

Server-Side Encryption with Customer Provided keys (SSE-C)

Start course
Overview
Difficulty
Beginner
Duration
1h 32m
Students
858
Ratings
4.8/5
starstarstarstarstar-half
Description

This section of the Solution Architect Associate learning path introduces you to the core encryption concepts and services relevant to the SAA-C02 exam. We overview the AWS encryption options and how to select and apply AWS encryption services to meet relevant situations and scenarios. 

Want more? Try a lab playground or do a Lab Challenge!

Learning Objectives

  • Learn the fundamentals of Amazon's Key Management Service (KMS), including permissions, key policies, and key management
  • Learn the fundamentals of CloudHSM, how it's implemented, and how to use it as a Custom Key Store in KMS
  • Learn how to implement server-side encryption

 

 

 
 
 
Transcript

Transcript

Server-Side Encryption with Customer Provided Keys, SSE-C. The encryption process is as follows. Firstly, a client uploads Object Data and the Customer-provided Key to S3 for a HTTPS. It will only work with the HTTPS connection. Otherwise, S3 will reject it. S3 will then use the Customer-provided Key to encrypt the Object Data. S3 will also create a sorted HMAC value of the Customer-provided Key for future validation requests. The encrypted Object Data, along with the HMAC value of the Customer Key is then saved and stored on S3. The Customer-provided Key is then removed from memory. The decryption process is as follows. A request is made by the client via HTTPS connection to S3 to retrieve the Object Data. At the same time, the Customer-provided Key is also sent with the request. S3 uses the HMAC value of the same key to confirm it's validity of the requested object. The Customer-provided Key is then used to decrypt the encrypted Object Data. The Object Data is then sent back to the client.

About the Author
Avatar
Stuart Scott
AWS Content Director
Students
171111
Labs
1
Courses
140
Learning Paths
97

Stuart has been working within the IT industry for two decades covering a huge range of topic areas and technologies, from data center and network infrastructure design, to cloud architecture and implementation.

To date, Stuart has created 90+ courses relating to Cloud reaching over 140,000 students, mostly within the AWS category and with a heavy focus on security and compliance.

Stuart is a member of the AWS Community Builders Program for his contributions towards AWS.

He is AWS certified and accredited in addition to being a published author covering topics across the AWS landscape.

In January 2016 Stuart was awarded ‘Expert of the Year Award 2015’ from Experts Exchange for his knowledge share within cloud services to the community.

Stuart enjoys writing about cloud technologies and you will find many of his articles within our blog pages.