Encrypting S3, EBS, and RDS at Rest

Encryption at rest protects data stored on disk so that stolen media or snapshots are unreadable.

AWS storage services integrate with KMS to encrypt data transparently. The application sees normal data; the encryption happens automatically beneath it.

Amazon S3 offers several server-side encryption (SSE) options:

• SSE-S3: keys fully managed by S3 (AES-256), now the default.
• SSE-KMS: keys in KMS, with audit and access control.
• SSE-C: you supply the key with each request.

Pick the SSE mode by control needs:

• SSE-KMS when you need auditing and key access control via CloudTrail and key policies.
• SSE-S3 for simple, automatic encryption.
• SSE-C when you must hold the keys yourself.

SSE-KMS makes a KMS call per object, which can be costly at scale. S3 Bucket Keys reduce this dramatically.

A short-lived bucket-level data key handles many objects, cutting KMS requests (and cost) by up to 99% while keeping KMS-backed encryption.

EBS (Elastic Block Store) volumes can be encrypted with KMS.

• Encryption covers the volume, its snapshots, and the data in transit between the volume and the instance.
• It is transparent to the EC2 instance, with negligible performance impact.

You cannot encrypt an existing unencrypted EBS volume directly. Instead:

• Take a snapshot, copy it with encryption enabled, and create a new volume from the encrypted copy.

Enabling EBS encryption by default at the account/region level prevents new unencrypted volumes.

RDS (Relational Database Service) encrypts the database storage, automated backups, read replicas, and snapshots with KMS.

• Encryption must be set at creation.
• To encrypt an existing unencrypted instance, restore an encrypted copy from a snapshot.

A key exam point: encryption status follows snapshots.

• Snapshots of an encrypted volume or DB are encrypted with the same key.
• To share an encrypted snapshot across accounts, you must share the KMS key too.

Most storage and database services support KMS encryption at rest, including:

• DynamoDB, EFS, Redshift, SQS, SNS, and Secrets Manager.

The pattern is consistent: pick a KMS key, and the service handles envelope encryption transparently.

A common worry is that encryption slows things down. In practice, KMS-backed encryption on EBS, S3, and RDS is transparent with negligible performance impact.

Applications need no code changes; they read and write normally while the service encrypts beneath them. This removes any excuse to leave data unencrypted for performance reasons.

Verify and enforce encryption with:

• AWS Config rules like s3-bucket-server-side-encryption-enabled and encrypted-volumes.
• Security Hub standards that flag unencrypted resources.

These continuously catch any resource that slips through unencrypted.

Choose the right S3 option.

You learned encryption at rest.

• S3 offers SSE-S3, SSE-KMS, and SSE-C; bucket keys cut KMS cost.
• EBS and RDS use KMS; encryption is set at creation and follows snapshots.
• Config rules and Security Hub verify encryption everywhere.