hands-on lab

Encrypting S3 Objects Using SSE-KMS

Difficulty: Beginner

Duration: Up to 45 minutes

Students: 8,806

Rating: 4.7/5

Start lab

Get guided in a real environmentPractice with a step-by-step scenario in a real, provisioned environment.

Learn and validateUse validations to check your solutions every step of the way.

See resultsTrack your knowledge and monitor your progress.

Description

Data security is an important consideration for anyone storing data in the cloud. Encrypting data at rest ensures that anyone gaining access to disks storing your data can only view it in encrypted format making it useless to attackers. There are several encryption at rest mechanisms that are supported by Amazon S3 object data storage. This lab focuses on Server-Side Encryption with CMKs Stored in AWS Key Management Service (SSE-KMS). This approach gives you control of the master key that generates data keys used by S3 performing encrypt and decrypt operations.

Lab Objectives

Upon completion of this Lab you will be able to:

Understand the benefits of SSE-KMS and when to use it
Create customer-managed customer master keys (CMKs) in AWS Key Management Service (KMS)
Use SSE-KMS encryption of objects at rest in S3 buckets
Enforce that all objects in an S3 bucket are encrypted using SSE-KMS and if desired, requiring a specific CMK for the encryption

Intended Audience

This lab is intended for:

Anyone interested in data security in AWS

Prerequisites

You should be familiar with:

Basic S3 concepts including buckets and objects
Knowledge of the available encryption options for S3 is beneficial but not required. You can complete the Understanding S3 encryption mechanisms to secure your data course to gain this knowledge