1.3 AWS KMS Envelope Encryption & S3 Bucket Security

🎯 Key AWS SAA-C03 Architectural Takeaways

• AWS KMS uses envelope encryption for payloads > 4 KB: data is encrypted with a plaintext Data Encryption Key (DEK), and the DEK is encrypted under the KMS Customer Managed Key.
• KMS symmetric Customer Managed Keys (CMKs) support automatic annual key rotation without changing the Key ID, ARN, or breaking access to older data.
• To enforce in-transit encryption on Amazon S3, apply a bucket policy with an explicit Deny on s3:* with condition Bool aws:SecureTransport: false.
• Amazon S3 Object Lock in Compliance mode enforces Write-Once-Read-Many (WORM) storage that cannot be deleted or modified by ANY user, including the account root user.

Data protection on AWS incorporates encryption in transit and encryption at rest. To enforce Transport Layer Security (TLS) for all object access to Amazon S3, architects apply a bucket policy with an explicit Deny statement for action s3:* where the condition Bool {'aws:SecureTransport': 'false'} evaluates to true. Any unencrypted HTTP request is immediately blocked with an HTTP 403 Access Denied.

AWS Key Management Service (KMS) manages cryptographic keys using FIPS 140-2 Level 3 validated Hardware Security Modules (HSMs). Because KMS has a direct API payload limit of 4 KB, AWS services leverage envelope encryption. The application calls kms:GenerateDataKey to receive a plaintext Data Key and an encrypted Data Key. The application encrypts the dataset with the plaintext key, immediately zeros memory, and stores the encrypted Data Key alongside the ciphertext.

KMS Customer Managed Keys (CMKs) offer automatic annual key rotation. When enabled, AWS KMS generates new cryptographic backing material every 365 days while preserving the key ARN, alias, and key policy. KMS maintains previous backing material to seamlessly decrypt historical data without manual re-encryption.

For financial and healthcare regulatory compliance (such as SEC Rule 17a-4), Amazon S3 Object Lock provides Write-Once-Read-Many (WORM) storage. In Compliance mode, objects cannot be overwritten, altered, or deleted by anyone—including the AWS account root user—until the retention period has lapsed, guaranteeing absolute data immutability.

⚠️ Common Pearson VUE / AWS Exam Traps

• Confusing default S3 encryption (encryption at rest) with aws:SecureTransport enforcement (encryption in transit).
• Selecting S3 Object Lock Governance mode when strict non-overridable compliance is required — Governance mode allows users with specific IAM rights to delete locked objects.
• Attempting to download or export KMS root key material — KMS root keys never leave the hardware security modules (HSMs) in plaintext.