Encrypting S3 Buckets and EBS Volumes Using KMS
Learn how to secure EBS volumes and S3 using AWS Key Management System.
In this lesson, we'll explore the encryption mechanisms for two prevalent AWS resources—S3 buckets and EBS volumes—secured using AWS KMS.
EBS volume encryption
The data stored on an EBS volume can be accessed by attaching the EBS volume with an EC2 instance and then reading the stored data using that instance. Note that, an EBS volume can be attached with multiple EC2 instances at the same time. So, if our EBS volume is unencrypted, anyone who gets access to our EBS volume can attach the volume with an EC2 instance and read the stored data.
Note: When we launch an EC2 instance, a root EBS volume is automatically created and connected to it. By default, this volume is not encrypted.
How does EBS volume encryption works?
To start off the encryption, we have to create a KMS key. After that, we specify that key as the encryption key for the EBS volume. KMS key, however, doesn’t directly encrypt the EBS volume. When we create an encrypted EBS volume, KMS generates a data key using the KMS key for encryption. An encrypted version of that data key is then stored within the metadata of the EBS volume.
Now, when an EBS volume is attached to an EC2 instance, AWS first checks if the principal attaching this volume to the EC2 instance has access to the specified KMS key. If yes, the EBS volume is attached; otherwise, this attachment fails. After the volume has been attached, the EC2 instance fetches the encrypted data key from the volume’s metadata, requests KMS to decrypt the key, and then uses the decrypted key to encrypt the data before storing it on the EBS volume.
Similarly, when the EC2 instance wants to read this encrypted data, it first obtains the decrypted version of the data key and then uses that key to decrypt the data.
The decrypted encryption key is deleted after the data has been stored or retrieved.
S3 data encryption
Amazon S3 allows users to encrypt their data using AWS Key Management Service (KMS) to manage encryption keys. This way, we can ensure that data uploaded to Amazon S3 is encrypted using AWS KMS, providing an additional layer of security for our sensitive data.
S3 data encryption is of the following types:
Client-side encryption: In this type of encryption, data is encrypted by the user locally and then transmitted to be stored in the S3 bucket. This secures the data both in transition and at rest.
Server-side encryption: In this type of encryption, S3 encrypts our data at the object level when it’s being stored in the bucket. This secures the data in the rest state. When a read request is made, S3 decrypts the data and provides the user with the decrypted data. Server-side encryptions are of further four types:
Encryption using S3 managed keys: The keys used for encryption are created and managed by S3. This is the default encryption method used by S3.
Encryption using KMS keys: The keys used for encryption are provided by KMS. These keys can be both AWS-managed or customer-managed KMS keys. Users have more control over these keys as compared to the S3 managed keys.
Encryption using customer-provided keys: The keys are provided and managed by the user. The user is responsible for ensuring the security and availability of these keys.
Dual-layer encryption using KMS keys: The keys are provided by KMS. This encryption provides a dual layer of encryption by using different encryption algorithms for each layer. It can be considered the most secure of these encryptions.
How does S3 data encryption with KMS work?
The process of encrypting and decrypting data for S3 buckets using KMS follows a consistent approach across all relevant encryption types. We'll just look at how dual-layer server-side encryption works.
When a KMS key is specified as the encryption key for an S3 bucket, a data key is generated using that KMS key. This encrypted version of this data key is stored as the metadata of the S3 bucket.
When an object is uploaded to the bucket:
S3 requests the KMS to decrypt the encrypted data key.
KMS decrypts that key and sends the plaintext key to S3.
S3 uses multiple encryption algorithms to encrypt the input object twice and stores the encrypted object in the bucket.
S3 deletes the plaintext key, so in case of unauthorized access, this key is not compromised, and the unauthorized user is not able to decrypt the data.
Similarly, when we try to read the object, S3 again obtains the decrypted version of the data key and then uses that key to decrypt the data which is then returned to the requesting entity.
If the requesting entity does not have access to the KMS key, they are not able to read the data. This ensures that the data is secured and no unauthorized entity is able to access it.
Get hands-on with 1300+ tech skills courses.