AWS Encryption Fundamentals: Transit, At Rest, Symmetric and Asymmetric – SAP-C02 Study Guide

Purpose of This Lesson

AWS security questions often require you to identify what is being encrypted, when it is encrypted, and which type of cryptography is appropriate. This primer establishes the terminology needed to understand services such as AWS Key Management Service (AWS KMS), AWS CloudHSM, and AWS Certificate Manager (ACM).

The two main distinctions are:

• Encryption in transit versus encryption at rest: where the data is protected.
• Symmetric versus asymmetric encryption: how the cryptographic keys are used.

Key Concepts

Encryption in Transit

Encryption in transit protects data while it travels between systems over a network. HTTPS is a common example: a client establishes a TLS connection to an endpoint such as an Application Load Balancer, and data is protected while crossing the network.

This protection applies to the connection, not automatically to the stored data. After the load balancer terminates TLS, traffic may be unencrypted on the backend unless the architecture also uses encryption from the load balancer to the targets.

Common AWS examples include:

• HTTPS connections using certificates managed by ACM.
• TLS connections between clients and Application Load Balancers, Network Load Balancers, or CloudFront.
• TLS-enabled connections to databases, caches, queues, and other services.
• SSH connections used for secure administrative access.

A complete design may require encryption on every network segment, including:

Client --TLS--> Load Balancer --TLS--> Application --TLS--> Database

Whether each segment is encrypted depends on the security requirements and the capabilities of the participating services.

Encryption at Rest

Encryption at rest protects the data while it is stored. The data itself is transformed into ciphertext before being persisted and is decrypted when an authorized request reads it.

Typical AWS examples include:

• S3 server-side encryption for objects.
• EBS volume encryption.
• RDS and Aurora storage encryption.
• DynamoDB encryption at rest.
• Encrypted backups, snapshots, and logs where supported.

For example, with S3 server-side encryption, an object is encrypted as it is written to the bucket and decrypted when an authorized client retrieves it. Encryption at rest does not replace encryption in transit: clients should still use HTTPS when uploading or downloading objects.

Symmetric Encryption

Symmetric encryption uses one secret key for both encryption and decryption.

Plaintext + secret key -> ciphertext
Ciphertext + same secret key -> plaintext

The key must remain confidential. Anyone who obtains it may be able to decrypt data protected with that key, subject to any additional controls.

Symmetric encryption is generally efficient and well suited to encrypting large amounts of data. AWS storage encryption commonly uses envelope encryption, where a data encryption key encrypts the content and another key protects or manages that data key.

AWS KMS is primarily associated with symmetric KMS keys for common encryption-at-rest use cases, although KMS also supports asymmetric key types for selected cryptographic operations.

Asymmetric Encryption

Asymmetric encryption, also called public-key cryptography, uses a mathematically related key pair:

• A public key can be distributed.
• A private key must be protected.

Data encrypted with one key can be decrypted using the corresponding key in the pair, subject to the specific algorithm and operation. In practical systems, asymmetric cryptography is also used for digital signatures: a private key signs data and the corresponding public key verifies the signature.

Asymmetric cryptography is useful for authentication, secure key exchange, and signatures, but it is generally more computationally expensive than symmetric encryption for bulk data.

TLS uses asymmetric cryptography during connection establishment for authentication and key negotiation, then typically uses symmetric session keys for efficient application data transfer. SSH similarly relies on public-key mechanisms for authentication and secure session establishment.

Certificates and Encryption

A certificate binds a public key to an identity, such as a domain name. In AWS, ACM can provision and manage certificates used by integrated services such as Elastic Load Balancing and CloudFront.

A certificate does not by itself encrypt stored application data. It supports authenticated TLS connections, which provide encryption in transit when clients connect to the endpoint using HTTPS.

Exam-Relevant Takeaways

• Encryption in transit protects data while it moves across a network.
• Encryption at rest protects data while it is stored.
• Enabling TLS from a client to a load balancer does not automatically encrypt traffic from the load balancer to backend targets.
• Symmetric encryption uses one secret key and is efficient for bulk data.
• Asymmetric encryption uses public and private keys and is commonly used for authentication, key exchange, and signatures.
• TLS commonly combines both models: asymmetric cryptography for setup and authentication, followed by symmetric encryption for the session.
• A certificate supports identity verification and TLS; it is not the same thing as an encryption-at-rest key.
• AWS KMS, CloudHSM, and ACM solve different problems:
• KMS: managed key creation, protection, and authorization for AWS and application encryption operations.
• CloudHSM: dedicated customer-controlled hardware security modules for specialized cryptographic control and compliance requirements.
• ACM: certificate provisioning and lifecycle management for supported AWS services.

Architecture Decision Guide

Requirement	Relevant protection or service	Key consideration
Protect data between a browser and an AWS endpoint	TLS/HTTPS, commonly with ACM certificates	The endpoint must support TLS and use a valid certificate.
Protect traffic between load balancer and targets	Backend TLS configuration	Frontend TLS termination does not automatically provide end-to-end encryption.
Protect objects stored in Amazon S3	S3 server-side encryption, optionally with an AWS KMS key	Use bucket policies and key policies to control access in addition to encryption.
Encrypt EBS, RDS, or other supported AWS storage	Service-native encryption integrated with KMS	Encryption may need to be enabled when the resource is created; review service-specific migration options.
Encrypt large volumes of data efficiently	Symmetric encryption	Protect and control access to the secret key.
Authenticate identities or establish secure sessions	Asymmetric cryptography and certificates	Private keys require strong protection; certificates have identity and lifecycle concerns.
Require dedicated cryptographic hardware and customer control	AWS CloudHSM	Adds operational responsibility and is not a general replacement for KMS.
Need centralized AWS key permissions and auditing	AWS KMS	Use IAM and key policies, grants, and CloudTrail integration appropriately.

Common Exam Traps

• Confusing TLS with encryption at rest: HTTPS protects the network connection, not automatically the object, database, or volume where data is stored.
• Assuming frontend TLS means end-to-end TLS: If a load balancer terminates HTTPS and sends HTTP to targets, the backend segment is not encrypted in transit.
• Treating a certificate as a data-encryption key: ACM certificates are used for certificate-based TLS workflows; they do not directly provide general-purpose S3 or EBS encryption.
• Assuming asymmetric encryption is used for all application data: Public-key cryptography is relatively expensive for bulk data. Hybrid protocols commonly use asymmetric operations to establish a symmetric session key.
• Assuming encryption alone controls access: A correctly encrypted object is still exposed if IAM, bucket policies, security groups, endpoint policies, or KMS key policies grant unintended access.
• Assuming all AWS services use identical encryption workflows: AWS services differ in supported key types, customer-managed key options, key rotation behavior, and how encryption is enabled or changed.
• Confusing KMS and CloudHSM: KMS is a managed key service; CloudHSM provides dedicated HSMs and requires more customer management.

Real-World Engineer Notes

• Define encryption requirements per connection and per storage layer. A design may need both in-transit and at-rest encryption.
• Document TLS termination points. They are security boundaries where plaintext may exist unless re-encryption is configured.
• Use HTTPS for S3 and other service APIs even when server-side encryption is enabled.
• Treat private keys, KMS permissions, and CloudHSM credentials as high-value security assets.
• Use least privilege for both data access and key usage. Access to an encrypted resource and permission to use the associated KMS key are separate authorization concerns.
• For regulated workloads, identify whether the requirement is simply encryption, customer-managed key control, externally managed key material, or dedicated hardware. These requirements lead to different AWS designs.
• Consider availability and operations when adding TLS across internal service boundaries: certificate renewal, trust stores, hostname validation, and monitoring become part of the platform design.

Quick Reference Summary

• In transit: protects data while crossing a network, typically with TLS.
• At rest: protects data while stored, such as in S3, EBS, RDS, or backups.
• Symmetric: one secret key encrypts and decrypts; efficient for bulk data.
• Asymmetric: public/private key pair; useful for authentication, signatures, and secure key establishment.
• ACM: manages certificates for supported AWS integrations.
• KMS: manages cryptographic keys and access to encryption operations.
• CloudHSM: provides dedicated HSM infrastructure for specialized control.
• Strong designs commonly use both encryption in transit and encryption at rest.

Flashcards

1. Q: What does encryption in transit protect?

A: Data while it travels across a network, commonly through a TLS-protected connection.

1. Q: What does encryption at rest protect?

A: Data while it is stored in a service such as S3, EBS, RDS, or a backup repository.

1. Q: Does HTTPS automatically encrypt data after it reaches an Application Load Balancer?

A: No. Backend encryption depends on whether TLS is configured from the load balancer to the targets.

1. Q: What is the defining characteristic of symmetric encryption?

A: The same secret key is used for encryption and decryption.

1. Q: What is the defining characteristic of asymmetric encryption?

A: It uses a related public key and private key.

1. Q: Why is symmetric encryption commonly used for bulk data?

A: It is generally more efficient and less computationally expensive than asymmetric encryption.

1. Q: How does TLS typically use symmetric and asymmetric cryptography together?

A: Asymmetric cryptography supports authentication and session establishment; symmetric keys protect the application data exchanged afterward.

1. Q: What is the primary AWS service for managed encryption keys?

A: AWS Key Management Service, or AWS KMS.

1. Q: What is AWS Certificate Manager used for?

A: Provisioning and managing certificates for supported AWS services and TLS endpoints.

1. Q: What is the main distinction between KMS and CloudHSM?

A: KMS is a managed key management service, while CloudHSM provides dedicated HSMs with greater customer control and operational responsibility.

Practice Questions

Question 1

A company configures HTTPS between users and an Application Load Balancer. The load balancer forwards requests to EC2 instances over HTTP. The security team requires encryption across every network segment. What should the architect do?

Correct answer: Configure HTTPS or TLS from the load balancer to the EC2 targets as well as from clients to the load balancer.

Explanation: Client-to-load-balancer TLS protects only the frontend connection. Re-encrypting traffic to the targets provides protection on the backend segment.

Question 2

An application stores sensitive customer records in Amazon S3. The company requires the records to be encrypted while stored and protected while uploaded and downloaded. Which design meets both requirements?

Correct answer: Enable S3 server-side encryption and require HTTPS for S3 API access.

Explanation: S3 server-side encryption protects objects at rest. HTTPS protects the data while it moves between the application and S3. Both controls address different stages of the data lifecycle.

Question 3

A workload must encrypt terabytes of application data efficiently. The architect is choosing between symmetric and asymmetric encryption for the content itself. Which is the best choice?

Correct answer: Use symmetric encryption for the data, with protected key management such as AWS KMS.

Explanation: Symmetric encryption is efficient for bulk data. Asymmetric cryptography may still be used for authentication or securely exchanging keys, but it is not normally used to encrypt large data volumes directly.

Question 4

A company wants a trusted certificate for its public application running behind an AWS-integrated load balancer. It does not need dedicated cryptographic hardware. Which service is most appropriate for certificate lifecycle management?

Correct answer: AWS Certificate Manager.

Explanation: ACM provisions and manages certificates for supported AWS services. It addresses TLS certificate management, not general-purpose storage encryption or dedicated HSM requirements.

Question 5

An organization requires dedicated hardware security modules and direct control over cryptographic operations for a specialized compliance workload. Which AWS option best matches this requirement?

Correct answer: AWS CloudHSM.

Explanation: CloudHSM provides dedicated HSMs and greater customer control over the cryptographic environment. KMS is usually the simpler managed option when dedicated HSM control is not required.