How Does AWS Protect Sensitive Data? Understanding AWS KMS, Encryption & Key Management

Imagine you're building a web application and deploying it on AWS.

Your application stores customer information, database credentials, uploaded documents, and other sensitive data.

Now consider something important:

What happens if someone gains access to the underlying storage? Can they read your data?

This is where encryption becomes essential.

AWS provides several services and mechanisms to protect sensitive information. One of the most important is AWS Key Management Service (AWS KMS).

In this article, I'll explore how encryption works in AWS, what KMS does, how envelope encryption protects data, and how services such as Amazon S3 and AWS Secrets Manager use encryption in real-world applications.

Figure: Understanding AWS data protection through encryption, key management, and secure application architecture.

1. What Is Encryption?

Encryption is the process of converting readable information (plaintext) into an unreadable format (ciphertext) using a cryptographic algorithm and key.

For example:

Original Data (Plaintext)
          |
          v
      Encryption
          |
          v
    Encrypted Data
     (Ciphertext)
          |
          v
      Decryption
          |
          v
 Original Data Again

Without the appropriate decryption key, an unauthorized person should not be able to read the protected data.

Encryption is commonly used to protect:

• Customer information
• Database records
• Uploaded documents
• Application credentials
• Payment-related information
• Communication between applications

In cloud environments, encryption is generally considered in two important situations.

Encryption at rest

Encryption at rest protects data while it is stored.

Examples:

• Files stored in Amazon S3
• Database storage in Amazon RDS
• Volumes attached to Amazon EC2
• Backups and snapshots

Even if someone gains access to the underlying storage media, encrypted data remains protected without the required decryption capability.

Encryption in transit

Encryption in transit protects data while it travels between systems.

For example:

User Browser
     |
     | HTTPS / TLS
     |
     v
Application Load Balancer
     |
     | HTTPS (if configured)
     |
     v
Backend Application

HTTPS uses TLS to establish an encrypted connection between communicating parties.

Remember: Encryption at rest protects stored data, while encryption in transit protects data moving across a network.

2. What Is AWS KMS?

AWS Key Management Service (KMS) is a managed service that allows you to create and control cryptographic keys used to protect data.

Instead of building your own key management infrastructure, AWS KMS provides a managed way to create, manage, and use cryptographic keys.

KMS can integrate with many AWS services, including:

• Amazon S3
• Amazon EBS
• Amazon RDS
• AWS Lambda
• AWS Secrets Manager
• Amazon EFS

For example, when you enable SSE-KMS encryption on an S3 bucket, Amazon S3 can use a KMS key to protect the objects stored in that bucket.

The important thing is that KMS manages cryptographic keys. It does not replace the storage service where your actual application data lives.

3. Understanding AWS KMS Keys

A KMS key is a logical representation of a cryptographic key managed by AWS KMS.

There are several key ownership and management options.

AWS owned keys

These are managed by AWS and used across AWS services in supported scenarios.

• AWS manages the keys.
• Customers cannot view or manage them directly.
• There is no separate customer-facing key management charge.

AWS managed keys

These are created and managed by AWS services in your account.

For example, an AWS service might use an AWS managed KMS key to encrypt data.

• AWS manages the key lifecycle.
• You can view the key in your account.
• You have limited control compared with customer managed keys.

Customer managed keys

These are keys that you create and manage in AWS KMS.

You have greater control over:

• Key policies
• IAM permissions
• Key rotation options
• Key disabling and deletion
• Grants and access management

For example, an organization may create a customer managed KMS key specifically for encrypting sensitive customer documents.

This provides greater control over how the key is used.

4. How Does AWS KMS Encryption Work?

Let's imagine an application storing customer documents in Amazon S3.

When using KMS-based encryption, the application or AWS service can request cryptographic operations from KMS.

A simplified flow looks like this:

       Application
            |
            v
       Amazon S3
            |
            v
         AWS KMS
            |
            v
      KMS Key Used
       for Encryption
            |
            v
     Encrypted Object
       Stored in S3

However, there is an important concept behind this process: Envelope Encryption.

5. What Is Envelope Encryption?

Envelope encryption is a method of protecting data by encrypting the actual data with one key and protecting that key with another key.

This is particularly useful when applications need to encrypt large amounts of data.

Let's understand it step by step.

1. AWS KMS generates a data key.
2. The application uses the plaintext data key to encrypt the actual data.
3. The encrypted data key is stored alongside the encrypted data.
4. The plaintext data key is removed from memory when no longer needed.
5. When the data needs to be decrypted, the encrypted data key is sent to KMS.
6. KMS decrypts the data key, allowing the application to decrypt the original data.

Architecture:

              AWS KMS
                 |
                 v
        Generate Data Key
                 |
          +------+------+
          |             |
          v             v
    Plaintext Key   Encrypted Key
          |             |
          v             |
    Encrypt Data         |
          |             |
          v             v
     Encrypted Data + Encrypted Data Key
                 |
                 v
             Storage

Why is this useful?

Instead of sending large amounts of application data directly to KMS for encryption, the application can use a data key locally to encrypt the data.

KMS protects the data key.

This approach improves scalability and is widely used in cloud encryption systems.

6. How Does Amazon S3 Protect Stored Data?

Amazon S3 supports multiple server-side encryption options.

Let's look at the important ones.

SSE-S3

Server-Side Encryption with Amazon S3 managed keys.

• Amazon S3 manages the encryption keys.
• Encryption and decryption are handled automatically by S3.
• Suitable for many standard object-storage use cases.

SSE-KMS

Server-Side Encryption with AWS KMS keys.

• Uses AWS KMS to protect encryption keys.
• Supports customer managed keys and AWS managed keys.
• Provides additional control through KMS policies and permissions.
• Can provide audit visibility through AWS logging services.

This is particularly useful when organizations need more control over encryption key access.

SSE-C

Server-Side Encryption with Customer-Provided Keys.

• The customer supplies the encryption key with each relevant request.
• Amazon S3 performs the encryption and decryption.
• The customer is responsible for securely managing the key.

For most applications, SSE-S3 or SSE-KMS is easier to manage than SSE-C.

Quick comparison

Important: S3 automatically encrypts new object uploads with SSE-S3 by default. You can configure SSE-KMS when you need KMS-based key management and additional access controls.

7. How Does AWS Secrets Manager Protect Sensitive Information?

Encryption is not only about files and databases. Applications also need to protect sensitive credentials.

Imagine your backend needs to connect to MongoDB or an RDS database.

A dangerous approach would be storing credentials directly inside your source code:

const dbPassword = "my-secret-password";

If this code is pushed to GitHub, your credentials could be exposed.

Instead, AWS provides AWS Secrets Manager.

Secrets Manager helps you:

• Store database credentials and API keys.
• Retrieve secrets securely through authorized applications.
• Rotate supported secrets automatically when configured.
• Integrate with AWS KMS for encryption at rest.

A simplified architecture:

        Backend Application
                |
                v
             IAM Role
                |
                v
       AWS Secrets Manager
                |
                v
             AWS KMS
                |
                v
       Encrypted Secret

For example, an ECS task can use its task role to retrieve a specific database secret from Secrets Manager.

KMS helps protect the secret at rest, while IAM controls whether the application is authorized to retrieve it.

Remember the difference:

• IAM controls who can access a secret.
• Secrets Manager stores and manages the secret.
• KMS protects encryption keys used to encrypt the secret.

8. What Happens If Someone Tries to Access an Encrypted Resource?

Encryption alone does not guarantee authorization.

AWS also uses IAM policies, KMS key policies, and other access-control mechanisms to determine whether a request is permitted.

For example, imagine a developer has permission to read an encrypted S3 object but does not have the required KMS permissions.

The developer may still be unable to decrypt and read that object.

For SSE-KMS, access generally requires the appropriate S3 permissions and KMS permissions, subject to the applicable key policy, IAM policy, grants, and other authorization rules.

This gives organizations another layer of access control.

9. Real-World AWS Architecture Example

Let's bring everything together using a simple application architecture.

Imagine a React frontend and Node.js backend deployed on AWS.

             User
               |
               v
          CloudFront
               |
               v
         React Frontend
               |
               v
        Application API
               |
          +----+-----+
          |          |
          v          v
      Amazon S3   AWS Secrets
       Documents   Manager
          |          |
          v          v
       AWS KMS    AWS KMS
          |          |
          v          v
      Encrypted   Encrypted
       Objects     Secrets
          |
          v
       Storage

      HTTPS / TLS protects
      data in transit

In this architecture:

• CloudFront delivers the frontend securely.
• HTTPS/TLS protects communication in transit.
• Amazon S3 stores uploaded documents.
• AWS KMS protects encryption keys used for S3 encryption.
• Secrets Manager stores sensitive application credentials.
• IAM roles control which services can access these resources.

This is a simplified example, but it demonstrates how different AWS services work together to protect application data.

10. What Should You Remember for the AWS SAA-C03 Exam?

Here are some important points:

• Encryption at rest: Protects stored data.
• Encryption in transit: Protects data moving across networks.
• AWS KMS: Managed service for creating and controlling cryptographic keys.
• Customer managed key: Gives customers greater control over key management.
• AWS managed key: Managed by AWS on behalf of a customer in their account.
• Envelope encryption: Encrypts data using a data key and protects that data key using another key.
• SSE-S3: Amazon S3 manages the encryption keys.
• SSE-KMS: Uses AWS KMS for key management.
• SSE-C: Customer provides and manages the encryption key.
• AWS Secrets Manager: Stores and manages sensitive information such as credentials.
• IAM: Controls permissions to access AWS resources and use KMS keys.

One more important exam concept:

Disabling a KMS key prevents it from being used for cryptographic operations. Deleting a KMS key is a separate operation and can permanently make encrypted data unrecoverable if no usable copy of the key remains.

Final Thoughts

When I started learning cloud computing, I mainly focused on deploying applications and connecting AWS services.

But understanding encryption made me realize that a production-ready application needs more than just working infrastructure.

It needs proper access control, secure communication, encryption, and responsible key management.

AWS KMS, Amazon S3, IAM, and Secrets Manager work together to provide these security capabilities.

My biggest takeaway from this topic is simple:

Protecting data is not just about encrypting it. It's also about controlling who can decrypt it and how encryption keys are managed.

I'm continuing my AWS learning journey and documenting the concepts that help me understand how real-world cloud applications are built and secured.