KMS, ACM, and Encryption Patterns

Encryption is a fundamental security control that protects data confidentiality even if storage media is compromised or access is gained through other means. AWS provides encryption for data at rest (stored in databases, S3, EBS) and in transit (moving across networks). Key services: AWS Key Management Service (KMS) manages encryption keys for at-rest encryption. AWS Certificate Manager (ACM) provisions and manages TLS certificates for in-transit encryption. Understanding when and how to apply each is essential for the Security Architecture domain of SAA-C03.

AWS KMS is a fully managed service for creating and controlling encryption keys. KMS uses Hardware Security Modules (HSMs) to protect keys — the key material never leaves the HSM unencrypted. KMS integrates with most AWS services for server-side encryption. Types of keys: AWS Managed Keys (free, auto-rotated annually, you cannot control them directly), Customer Managed Keys (CMK) ($1/month each, you control rotation, key policy, and deletion). Custom Key Store uses your own CloudHSM cluster for compliance requirements that mandate dedicated HSMs.

Every KMS key has a key policy — a resource-based policy that controls who can use and manage the key. Unlike IAM policies which are identity-based, key policies are required: the key policy must explicitly grant access for IAM policies to take effect. Best practice: separate key administration (who can manage the key) from key usage (which services and roles can encrypt/decrypt). Use key grants for temporary delegated access — for example, grant an EMR cluster temporary use of a KMS key for a job without modifying the key policy.

KMS uses envelope encryption to protect large amounts of data efficiently. You cannot encrypt more than 4 KB directly with a KMS key. Instead: KMS generates a Data Encryption Key (DEK) — a random key used to encrypt your actual data locally. The DEK is then encrypted by your KMS key (the Key Encryption Key). You store the encrypted DEK alongside the encrypted data. To decrypt, you first call KMS to decrypt the DEK, then use the plaintext DEK locally to decrypt the data. This is how S3, EBS, and RDS encryption work under the hood.

Key rotation is a security best practice that periodically replaces cryptographic key material, limiting the exposure window if a key is compromised. For Customer Managed Keys, you can enable automatic annual rotation — KMS generates new key material and uses it for new encrypt operations, while retaining old key material to decrypt existing data. AWS Managed Keys rotate automatically every year. Imported key material does NOT support automatic rotation (you must manually rotate). After rotation, new KMS operations use the new key material automatically without application changes.

S3 supports three server-side encryption options: SSE-S3 — S3 manages keys using AES-256, free, minimum control. SSE-KMS — uses a KMS key (AWS managed or CMK), provides key audit trail in CloudTrail, supports key policies, costs per KMS API call. SSE-C — you provide and manage the key material with each request; S3 never stores the key. Use SSE-KMS when you need audit control over who used the key and when. Use SSE-S3 for low-sensitivity data where simplicity and cost matter. Enforce encryption with a bucket policy that denies PutObject without encryption.

AWS Certificate Manager (ACM) provisions, manages, and auto-renews SSL/TLS certificates for AWS services at no cost. ACM certificates can be used with ALB, NLB, CloudFront, API Gateway, and AppSync. ACM handles the certificate lifecycle automatically — it renews certificates 60 days before expiry and deploys the renewal transparently. You can request certificates for domains you own (validated via DNS or email) or import third-party certificates. ACM certificates are NOT downloadable — they are bound to the AWS service they are associated with.

ACM Private CA (Certificate Authority) lets you create a fully managed, private CA hierarchy for issuing certificates to internal resources — EC2 instances, containers, internal APIs, and IoT devices. Unlike public ACM certificates (used with internet-facing services), private CA certificates can be issued for any internal hostname or IP address. Use Private CA for: mutual TLS (mTLS) between microservices, certificate-based authentication for VPN, and compliance requirements for internal PKI. Private CA costs $400/month for the CA plus $0.75 per certificate issued.

For EBS volume encryption, enable it at volume creation time (or copy an existing volume with encryption enabled). All data on the volume, including snapshots, is encrypted using the KMS key you specify. EBS encryption is transparent to the operating system — no application changes needed. For RDS encryption, enable it when creating the DB instance; you cannot encrypt an existing unencrypted RDS instance directly. Workaround: create an encrypted snapshot from an unencrypted instance, then restore to a new encrypted instance. Both EBS and RDS encrypted snapshots stay encrypted when copied.

Understanding the distinction between server-side and client-side encryption is important for the SAA-C03 exam. Server-side encryption: AWS encrypts data after receiving it and decrypts before delivering it — the data is in plaintext between your application and AWS. Client-side encryption: you encrypt data before sending it to AWS — AWS stores only ciphertext and never sees the plaintext. Use client-side encryption for the highest data sensitivity where you cannot trust the cloud provider to handle plaintext, such as healthcare records or financial data under strict regulations.

KMS keys can be shared across AWS accounts for cross-account encryption scenarios. For example, if Account A's application writes encrypted data to an S3 bucket owned by Account B, Account A's KMS key must allow Account B's principal to use it. Configure the KMS key policy in Account A to grant cross-account access, then create an IAM policy in Account B to allow the role to use Account A's key. This pattern is common in data-sharing and multi-account architectures where a central account manages encryption keys.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: KMS manages encryption keys with HSM protection and supports CMKs for fine-grained access control and audit trails, ACM provisions and auto-renews TLS certificates for AWS services at no charge, and encryption can be applied server-side (KMS) or client-side, with server-side being the most common pattern for AWS-native workloads. Enforce encryption with bucket policies that deny unencrypted operations. Next up we explore GuardDuty, Inspector, and Macie.