Encryption, keys and secrets

Why encrypt in the cloud?

Encryption turns readable data (plaintext) into scrambled data (ciphertext) that only someone with the right key can read back. Encryption at rest protects stored data: if a disk is lost or a snapshot is shared by mistake, the data is useless without the key. Encryption in transit protects data moving over a network, so nobody in between can read or change it. Many laws and standards, such as PCI DSS for card data, expect both.

Envelope encryption

Encrypting gigabytes directly with a master key held in a central service would be slow, because every byte would travel to that service. Instead, the cloud uses envelope encryption. A data key encrypts your data locally and quickly. Then the master key, which never leaves the key service, encrypts the data key. You store the encrypted data key next to the data. To read, you ask the key service to decrypt the small data key, then decrypt the data locally.

# Ask KMS for a data key: you get it in plaintext (use, then forget) and encrypted (store it)
aws kms generate-data-key --key-id alias/payments-key --key-spec AES_256

# Customer managed key with yearly automatic rotation
aws kms create-key --description "Payments data key"
aws kms create-alias --alias-name alias/payments-key --target-key-id <key-id>
aws kms enable-key-rotation --key-id <key-id>

KMS keys: AWS managed or customer managed

A key policy is the resource policy on a KMS key. It decides who can administer the key and who can use it to encrypt and decrypt. With a customer managed key, a developer who has s3:GetObject but no kms:Decrypt still cannot read the encrypted object. That separation is why regulated companies prefer customer managed keys. Rotation creates new key material; old material is kept so old data can still be decrypted.

Defaults help: since January 2023, Amazon S3 encrypts every new object at rest (SSE-S3). You can turn on EBS encryption by default for each region, and RDS encryption is chosen when you create the database. Azure Key Vault and Google Cloud KMS play the same role on the other clouds.

Encryption in transit: TLS and ACM

TLS (Transport Layer Security) is the protocol behind HTTPS. Use TLS 1.2 or newer everywhere, including between your load balancer and your servers when the data is sensitive. AWS Certificate Manager (ACM) issues free public TLS certificates for services it integrates with, such as load balancers, CloudFront and API Gateway, and renews them automatically. A certificate for CloudFront must be created in us-east-1. You can force HTTPS on a bucket with a policy like this:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyPlainHTTP",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::upi-reports", "arn:aws:s3:::upi-reports/*"],
    "Condition": { "Bool": { "aws:SecureTransport": "false" } }
  }]
}

Secrets management

A secret is any value that grants access: a database password, an API token, a private key. Never hard-code secrets in source code, Docker images or environment files committed to Git. Put them in a secrets manager, and let the app fetch them at runtime through its role.

• AWS Secrets Manager: stores secrets, encrypts them with KMS, and can rotate them automatically (managed rotation for RDS, or a Lambda function you write). Charged per secret per month.
• AWS Systems Manager Parameter Store: SecureString parameters encrypted with KMS. Standard parameters have no extra charge, but rotation is your job.
• Azure Key Vault: secrets, keys and certificates in one service.
• Google Cloud Secret Manager: versioned secrets with IAM per secret.

aws secretsmanager get-secret-value --secret-id prod/payments/db --query SecretString --output text
aws ssm get-parameter --name /payments/api-token --with-decryption

Data classification and backups

Data classification means labelling data by sensitivity, for example Public, Internal, Confidential and Restricted. Payment data, Aadhaar numbers and health records are Restricted. The label decides the controls: Restricted data gets customer managed keys, strict access, extra logging and no copies in test environments. Tag buckets and databases with their class. Backups must be encrypted too, and copies in a separate account protect you if the main account is compromised.