Week 4: Protecting Your Data at rest and in transit
Exploring how to protect your data through encryption, access control, and security features.
Series: AWS Cloud Security (4 articles)
- …
- 4Week 4: Protecting Your Data at rest and in transit This article
One thing I’m beginning to appreciate about cloud security is that storing data securely involves much more than encrypting it. It also requires controlling access, protecting data in transit, managing encryption keys, and preparing for accidental deletion or unwanted changes.
While exploring AWS data protection, I spent time understanding how different security controls work together, particularly within Amazon S3.
Protecting Data at Rest
Amazon S3 automatically encrypts new objects at rest using server-side encryption with Amazon S3-managed keys (SSE-S3) by default.
I also explored AWS Key Management Service (AWS KMS) and how it works with S3 through SSE-KMS. This helped me understand that encryption is not just about converting readable data into ciphertext. Key management and permissions are equally important because they determine who can use the keys to access protected information.
A Hands-On Observation with Amazon S3
During my practical exercise, I made an S3 object public to test its accessibility, but I couldn't access it because the object was encrypted.
This caught my attention and made me think more carefully about how S3 security controls interact. It also highlighted an important distinction: making an object public and being able to retrieve its contents are not the same thing.
In practice, successful access depends on several factors, including the bucket and object permissions, public access settings, and whether the requester is authorized to use the relevant encryption key.
This was a useful reminder that cloud security requires understanding how different controls work together, rather than looking at each setting in isolation.
Encryption Doesn't Replace Access Control
Features such as S3 Block Public Access, bucket policies, and IAM policies help control who can access data and what actions they can perform.
I also learned about S3 Versioning and S3 Object Lock, which provide different ways to protect stored objects against accidental deletion, overwrites, or unwanted changes.
The principle of least privilege remains essential: users and applications should receive only the permissions they need.
Protecting Data in Transit
Data protection doesn't stop when information is stored.
HTTPS/TLS helps protect data as it travels between users, applications, and AWS services. AWS Certificate Manager simplifies certificate management for supported services and applications.
This reinforced an important point for me: data needs protection both at rest and in transit.
Beyond Encryption
I also explored other AWS services that support data protection:
- AWS Secrets Manager: Securely stores and manages sensitive information such as database credentials and API keys.
- Amazon Macie: Helps discover sensitive data in Amazon S3 and identify potential data security risks Using Machine learning.
- AWS CloudTrail: Records account activity and API events, supporting auditing and security investigations.
Each service addresses a different part of the security picture. Together with appropriate access controls, monitoring, and recovery measures, they help build a stronger security posture.
My Biggest Takeaway
Consider an application storing confidential customer records in an S3 bucket. Encryption protects the stored objects, IAM and bucket policies control access, HTTPS protects data in transit, and versioning can help recover previous object versions.
But these controls must be configured correctly and used together.
Security isn't simply about enabling features. It's about understanding the risks each feature addresses and applying the right controls to the right resources.
As I continue building my AWS cloud engineering and security skills, I'm learning to look beyond whether a service works and ask a more important question:
How securely have I designed it?
I'd be interested to hear from other AWS builders: When securing data in Amazon S3, which security control do you consider most important beyond encryption, and why?
Series: AWS Cloud Security (4 articles)
- …
- 4Week 4: Protecting Your Data at rest and in transit This article
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article