Stop 07 · Identity & SecurityTopics · 5/10

Encryption at Rest & in Transit

In short

Data is at risk in two places: sitting on a disk and moving over a network. You need a lock for each, and in the cloud both are mostly a checkbox you must remember.

Encrypting stored data (at rest) and data moving across a network (in transit) — most managed cloud services support this natively, but it's often not enabled by default and needs to be deliberately configured.

The blob character padlocks a steel trunk next to a taped courier parcel.

Think of it like this

Locked trunk, sealed parcel

At home, Nani's jewellery sits in a padlocked steel trunk. When she sends a gift to Pune, it goes in a sealed, taped parcel so nobody on the way can peek. One lock for storage, one for the trip.

Watch it happen

A file's trip from phone to disk

Phone app

TLS tunnel

KMS key

S3 disk

1/5The app uploads a photo over https://. Without TLS, anyone on the hostel Wi-Fi could read it.

The big ideas

What you need to know

In transit = TLS

Use HTTPS everywhere, including between your own services. Enforce it with bucket policies like aws:SecureTransport.

At rest = disk encryption

S3 now encrypts new objects by default. For EBS and RDS, turn encryption on when you create them.

KMS holds the keys

A key management service stores master keys, logs every use and lets you control who can decrypt.

Not a permission fix

If IAM lets someone read the data, encryption decrypts it for them. Encryption and access control work together.

See it in code

Walk through the code

bash

1# Encrypt a new EBS volume with your own KMS key2aws ec2 create-volume --size 20 --availability-zone ap-south-1a \3  --encrypted --kms-key-id alias/app-data4 5# Make every new volume in this region encrypted6aws ec2 enable-ebs-encryption-by-default7 8# Upload to S3 with a specific KMS key9aws s3 cp notes.pdf s3://campus-app/ --sse aws:kms --sse-kms-key-id alias/app-data

1/3--encrypted plus a KMS key alias. Snapshots of this volume stay encrypted too.

ap-south-1 is the Mumbai region. Encryption by default is per region, so turn it on in each one you use.

Save yourself the pain

Common mistakes

Oops

Planning to "add encryption later" to an existing RDS database.

Do this instead

RDS encryption is set at creation. Changing it later means snapshot, copy encrypted, restore. Decide on day one.

Oops

Allowing plain http:// to an internal API because it's "inside the VPC".

Do this instead

Use TLS inside too. Internal traffic can still be sniffed by anything compromised on the same network.

Your mission

Lock both doors

~30 min

Quick check

An attacker steals valid IAM keys that allow s3:GetObject on an encrypted bucket. What happens?

Go deeper

1Enable encryption at rest on a storage resource and verify it in the console.
2Confirm a service's endpoints only accept encrypted (HTTPS/TLS) connections.
3Learn the difference between provider-managed keys and customer-managed encryption keys.