AWS Security, Encryption, and Threat Detection

In-Flight Encryption (TLS/SSL)

Encrypts data on the client side before sending and decrypts on the server.

Server-Side Encryption at Rest

Data is received in plaintext, then encrypted by the server upon arrival.

Client-Side Encryption

Data is encrypted before sending and decrypted only after the receiving client gets it.

AWS KMS Integration Standard

The default service for encryption at rest across S3, EBS, RDS, and SSM.

KMS Symmetric Keys (AES-256)

Uses a single key to encrypt and decrypt; default choice for AWS services.

KMS Asymmetric Keys (RSA & ECC)

Consists of a Public Key (downloadable) and a Private Key (remains in KMS).

AWS Owned Keys

Free, default keys used internally by AWS services (e.g., SSE-S3).

AWS Managed Keys

Free keys named aws/service-name that automatically rotate every 1 year.

Customer Managed Keys (Created)

Cost $1/month; support automatic rotation (must be enabled) or on-demand rotation.

Customer Managed Keys (Imported)

Cost $1/month; support manual rotation only using key aliases.

KMS Key Policy Requirement

You cannot grant access to a KMS key without a Key Policy.

KMS Multi-Region Keys

Identical KMS keys in different regions sharing the same key ID and material.

SSM Parameter Store

Secure storage for configuration values and secrets; supports hierarchy and TTL policies.

AWS Secrets Manager

Service for secrets like database credentials; features automatic Lambda-based rotation.

KMS vs. CloudHSM Tenancy

KMS is multi-tenant; CloudHSM is single-tenant (dedicated hardware).

KMS vs. CloudHSM Network

KMS uses an AWS managed endpoint; CloudHSM is deployed inside your VPC.

AWS Certificate Manager (ACM)

Provisions and deploys free public TLS certificates with auto-renewal starting 60 days before expiration.

AWS WAF (Web Application Firewall)

Operates at Layer 7 to inspect and block SQLi, XSS, and bad IPs.

AWS Shield Standard vs. Advanced

Standard is free L3/L4 protection; Advanced is $3,000/month with 24/7 SRT support.

AWS Firewall Manager

Centrally manages WAF rules, Shield, and Security Groups across an AWS Organization.

Amazon GuardDuty

Threat detection service using ML on CloudTrail, VPC Flow, and DNS logs.

Amazon Inspector

Automated vulnerability scanner for EC2 instances, ECR container images, and Lambda code.

Amazon Macie

Uses ML and pattern matching to discover and protect sensitive data/PII in S3.