Cianplan

Level 4: Reliability, security & cloud · L4.6 AWS architecture decisions (SAA-C03)

Protecting data: KMS, S3 controls, certificates and backups

Choose SSE-S3, SSE-KMS, SSE-C or client-side encryption, write the key and bucket controls that stop a leak, use ACM for TLS, and design backups that survive a compromised account.

13 min · Pro

What you take away

  • Every new S3 object is already encrypted with SSE-S3; choose SSE-KMS with a customer managed key when you need a separate decrypt permission, a key you can disable, and a record of key use.

And 4 more inside the class, in Pro.

How the class is laid out

  1. The problem
  2. The simple version
  3. Keys: KMS is the envelope from L4.4.3
  4. Who gets in: the controls that stop a leak
  5. Copies that survive a compromised account
  6. Check your understanding