Encryption at Rest
Data ProtectionEncryption at Rest protects data stored on disk (S3 objects, EBS volumes, RDS databases, DynamoDB tables) by encrypting it with a cryptographic key. Even if someone gains physical access to the storage hardware, the data is unreadable without the key.
AWS Encryption Options
- SSE-S3: AWS manages both the key and encryption process (default for S3 since Jan 2023)
- SSE-KMS: AWS KMS manages the key; you control key policies, rotation, and audit via CloudTrail
- SSE-C: you provide your own key; AWS encrypts/decrypts but never stores the key
- Client-side encryption: you encrypt data before sending it to AWS
Services with Default Encryption
S3 (SSE-S3 default since January 2023), EBS (AES-256, opt-in per region), RDS (optional, must be enabled at creation), DynamoDB (AWS owned key by default), and most newer services encrypt by default.
Related Content
Related Terms
Protecting data as it moves between systems by encrypting the communication channel, typically using TLS/SSL to prevent interception or tampering.
A cryptographic key managed by AWS Key Management Service used to encrypt and decrypt data across AWS services, with centralized key policies and automatic rotation.
A two-tier encryption strategy where data is encrypted with a data key, and the data key itself is encrypted with a master key (KMS key), combining performance with security.
Encryption performed by AWS on data after it is received by the service, protecting it at rest without requiring client-side encryption logic.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.