Encryption at Rest (KMS)
Protect stored data across S3, RDS, EBS, EFS, and Secrets Manager via KMS.
Encryption at rest protects data stored on disks, databases, object storage, backups, and snapshots by converting it into ciphertext using cryptographic keys. Even if the underlying storage media is accessed without authorization, the data remains unreadable without the appropriate keys. AWS provides native encryption for most storage services through integration with AWS Key Management Service (AWS KMS).
Objectives
- Protect sensitive data stored in AWS services.
- Prevent unauthorized access to stored information.
- Meet regulatory and compliance requirements.
- Secure backups, snapshots, and archived data.
- Centralize encryption key management using AWS KMS.
- Reduce operational complexity through managed encryption.
Architecture
Encryption process
- The application writes data to an AWS storage service.
- The storage service requests a data encryption key from AWS KMS.
- AWS KMS encrypts the data encryption key using a KMS key.
- The storage service encrypts the data before writing it to disk.
- When data is requested, the encrypted data key is decrypted by AWS KMS.
- The storage service transparently decrypts the data before returning it.
AWS services supporting encryption at rest
| Service | What is encrypted | Recommended key |
|---|---|---|
| Amazon S3 | Objects (SSE-S3, SSE-KMS, or SSE-C) | SSE-KMS |
| Amazon RDS / Aurora | Storage, automated backups, read replicas, snapshots, transaction logs | KMS key at creation |
| Amazon EBS | Volumes, snapshots, snapshot copies | KMS key |
| Amazon EFS | File system data | KMS key |
| AWS Secrets Manager | DB credentials, API keys, tokens, certificates, application secrets | KMS key |
AWS KMS features
- Customer Managed Keys (CMKs) and AWS Managed Keys.
- Automatic key rotation.
- IAM-based access control and fine-grained key policies.
- CloudTrail integration for auditing.
Best practices
- Use KMS Customer Managed Keys (CMKs) for sensitive workloads.
- Enable automatic key rotation where appropriate.
- Apply least-privilege IAM permissions to KMS keys.
- Encrypt all production databases and storage services.
- Encrypt backups, snapshots, and replicated storage — see Database Backup & Recovery.
- Monitor KMS usage with AWS CloudTrail and Amazon CloudWatch.
- Regularly review key policies and access permissions.