Protecting Data with Encryption and Backups

Encrypting data at scale creates a chicken-and-egg problem: encrypting a large object directly with a KMS key is slow, but a symmetric key stored in plaintext next to the data it protects isn't really protecting anything. AWS KMS solves this with envelope encryption: KMS generates a short-lived, random data key, uses your KMS key to encrypt just that data key, and hands both back to you. You encrypt the actual data locally with the plaintext data key, discard the plaintext copy, and store the encrypted data alongside the encrypted data key. The KMS key itself never leaves AWS KMS unencrypted — decrypting always means asking KMS to decrypt the small data key, not the bulk data.

A KMS key can be an AWS managed key (created and rotated automatically by an integrated service, and you can't edit its key policy) or a customer managed key (you control its key policy, its rotation schedule, and whether it can ever be deleted). Access to a KMS key is governed by its key policy — a resource policy attached to the key itself — working alongside any IAM identity policies, the same way an S3 bucket policy works alongside IAM.

{
  "Sid": "AllowReportingRoleToDecrypt",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::111111111111:role/ReportingRole"
  },
  "Action": ["kms:Decrypt", "kms:DescribeKey"],
  "Resource": "*"
}

Protecting data in transit means terminating TLS with a certificate AWS trusts. AWS Certificate Manager (ACM) issues public TLS certificates and, when you use them with an integrated service such as Elastic Load Balancing, Amazon CloudFront, or Amazon API Gateway, renews them automatically before they expire — no manual certificate rotation to schedule. ACM certificates are trusted by all major browsers because they chain up to Amazon's public certificate authority.

One regional detail matters for a common architecture: if you want to attach an ACM certificate to a CloudFront distribution, you must request or import that certificate in the US East (N. Virginia) Region, regardless of which Region your origin servers run in. A certificate requested in any other Region simply won't show up as an option when you configure CloudFront.

ACM also lets you import a certificate issued by a third-party certificate authority, which is the option to reach for when a compliance requirement mandates a specific external CA rather than Amazon's own.

Encryption protects data from being read; it does nothing to protect data from being lost. That's a separate control: data recovery. Amazon S3 versioning keeps every version of an object so an accidental overwrite or delete isn't the last word, and cross-Region replication keeps a second copy in another Region for resilience or compliance. Amazon RDS takes automated daily snapshots plus continuous transaction logs, giving you point-in-time restore within your configured retention window, in addition to manual snapshots you keep as long as you like.

Data classification is the step before any of this: deciding which datasets are sensitive enough to need customer managed KMS keys, tighter key policies, and stricter retention, versus which can use simpler AWS managed defaults. Get the classification right first, and the encryption and backup choices that follow become much easier to justify to an auditor.