Tutorial: AWS Certified Developer - Associate (DVA-C02)

Encryption at rest and in transit

Concepts

Encryption at rest and in transit are two critical security measures for protecting data. When preparing for the AWS Certified Developer – Associate (DVA-C02) exam, it’s important to understand the differences between the two and how AWS services implement these encryptions to secure data.

Encryption at Rest:

Encryption at rest is designed to protect data against unauthorized access when it is stored on a disk. In AWS, there are several services and mechanisms to encrypt data at rest:

Amazon S3: To encrypt objects in S3, you can use Server-Side Encryption (SSE) with AWS managed keys (SSE-S3), AWS Key Management Service (KMS) keys (SSE-KMS), or with a customer-provided key (SSE-C).
Amazon RDS: RDS supports encryption at rest using AWS KMS for all database engines.
Amazon EBS: Elastic Block Store volumes can be encrypted with KMS keys, which encrypts the entire volume and snapshots created from it.
Amazon DynamoDB: DynamoDB offers encryption at rest by default with no additional action required by the user, using service-managed keys.

Examples:

Enabling encryption on an S3 bucket:

{
“Rules”: [
{
“ApplyServerSideEncryptionByDefault”: {
“SSEAlgorithm”: “AES256” // or “aws:kms” for SSE-KMS
}
}
]
}

Creating an encrypted RDS instance:

aws rds create-db-instance \
–db-instance-identifier myencrypteddb \
–allocated-storage 100 \
–db-instance-class db.m4.large \
–engine mysql \
–master-username masterawsuser \
–master-user-password masterpassword \
–storage-encrypted \
–kms-key-id <your-kms-key-id>

Encryption in Transit:

Encryption in transit protects data as it moves from one location to another, such as across the internet or within a network. AWS provides numerous ways to secure data in transit:

Amazon VPC: Use VPC peering or AWS VPN to securely transmit data within or across AWS VPCs.
Amazon API Gateway: By default, API Gateway supports HTTPS for secure API communication.
AWS Transfer for SFTP/FTP/FTPS: You can securely transfer files into and out of Amazon S3 using the endpoints provided by AWS Transfer Family.
AWS Direct Connect: This service provides secure, private connections between your data center and AWS.

Examples:

Configuring an HTTPS listener in Elastic Load Balancer:

aws elbv2 create-listener \
–load-balancer-arn <your-load-balancer-arn> \
–protocol HTTPS \
–port 443 \
–certificates CertificateArn=<your-certificate-arn> \
–default-actions Type=forward,TargetGroupArn=<your-target-group-arn>

Comparison of Encryption at Rest and in Transit:

Encryption Type	Purpose	AWS Services Involved	Key Management
Encryption at Rest	Protecting stored data	S3, RDS, EBS, DynamoDB	AWS KMS, SSE-S3, customer-provided keys
Encryption in Transit	Protecting data while moving	VPC, API Gateway, AWS Transfer Family, ELB	SSL/TLS certificates, AWS managed keys

When studying for the AWS Certified Developer – Associate exam, candidates must understand how to implement these encryption methods and the scenarios in which they apply. AWS frequently updates its services, so always refer to the latest AWS documentation for the most current information on encryption capabilities and best practices.

Answer the Questions in Comment Section

True or False: Encryption at rest in AWS means encrypting data only when it is stored in Amazon S

(A) True
(B) False

Answer: B

Explanation: Encryption at rest refers to protecting data by encrypting it when it is stored on any persistent storage, not just Amazon S This includes services like EBS, RDS, and DynamoDB.

Which AWS service provides a managed hardware security module (HSM) to generate and use encryption keys?

(A) AWS Identity and Access Management (IAM)
(B) AWS Key Management Service (KMS)
(C) AWS CloudHSM
(D) AWS Certificate Manager (ACM)

Answer: C

Explanation: AWS CloudHSM provides a managed hardware security module to generate and use your own encryption keys.

Which of the following services does NOT support encryption at rest by default?

(A) Amazon EBS
(B) Amazon RDS
(C) Amazon EC2 Instance Store
(D) Amazon S3

Answer: C

Explanation: Amazon EC2 Instance Store does not support encryption at rest by default, whereas other listed services provide options to enable encryption at rest.

When enabling encryption in transit for Amazon RDS, which action is required?

(A) Enable SSL/TLS when connecting to the database instance
(B) Modify the RDS instance to use a specific port for encrypted traffic
(C) Enable an IAM policy that requires encryption
(D) Purchasing an SSL certificate from a third-party provider

Answer: A

Explanation: To enable encryption in transit for Amazon RDS, you must enable SSL/TLS when establishing a connection to the database instance.

True or False: AWS Key Management Service (KMS) can be used to manage keys for both encryption at rest and in transit.

(A) True
(B) False

Answer: A

Explanation: AWS KMS can be used to manage encryption keys for both encryption at rest and in transit, providing integrated services with many AWS products.

AWS Transit Gateway supports which types of encryption?

(A) Encryption at rest exclusively
(B) Encryption in transit exclusively
(C) Both encryption at rest and in transit
(D) Neither encryption at rest nor in transit

Answer: B

Explanation: AWS Transit Gateway supports encryption in transit for traffic that traverses it.

True or False: When using Amazon S3 client-side encryption, the encryption process is managed by the S3 service itself.

(A) True
(B) False

Answer: B

Explanation: When using client-side encryption, the encryption process is managed on the client’s side, not by the Amazon S3 service.

Amazon Aurora encrypts data at rest using:

(A) SSL certificates
(B) AES-256 encryption
(C) Transparent Data Encryption (TDE)
(D) SSH keys

Answer: B

Explanation: Amazon Aurora uses AES-256 encryption to protect data at rest. SSL is used for data in transit, and TDE is a term used in the context of SQL Server and Oracle databases.

True or False: AWS automatically encrypts traffic moving between availability zones within the same region.

(A) True
(B) False

Answer: B

Explanation: AWS does not automatically encrypt traffic between availability zones. Users are responsible for managing encryption if it is necessary for their applications.

Which of the following AWS services provides in-transit encryption by enforcing HTTPS?

(A) Amazon CloudFront
(B) AWS Storage Gateway
(C) AWS Direct Connect
(D) All of the above

Answer: D

Explanation: All the services mentioned (Amazon CloudFront, AWS Storage Gateway, and AWS Direct Connect) can enforce HTTPS for in-transit encryption.