Title: 🔐 Encrypting Data at Rest on AWS — Hands-on with S3, EBS, and KMS

Intro:
In the world of cloud computing, data security isn’t optional — it’s essential.

Get Joy Imarah’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This week, I completed the Guided Lab: Encrypting Data at Rest using AWS Encryption Options, where I explored how AWS services work together to protect data at every layer. From S3 buckets to EC2 volumes, I learned how encryption ensures that even if data is compromised, it remains unreadable without the right keys.

🧩 What I Did in the Lab

This hands-on lab walked me through the entire process of encrypting and managing data across AWS services:

1. Reviewed Default Encryption in S3:

• Discovered that S3 now automatically applies Server-Side Encryption with Amazon S3 Managed Keys (SSE-S3) to all new objects.
• Uploaded a sample object (clock.png) and confirmed it was transparently encrypted and decrypted when accessed.

2. Created a Customer Managed Key (CMK) with AWS KMS:

• Defined administrative and usage permissions using the voclabs IAM role.
• Understood the difference between AWS managed and customer managed keys.

3. Created and Attached an Encrypted EBS Volume:

• Created a 1 GiB encrypted EBS volume using the new MyKMSKey.
• Attached it to an EC2 instance and verified that the encryption key ID matched the CMK.

4. Disabled and Re-enabled the KMS Key:

• Observed how disabling the key made it impossible to reattach the encrypted EBS volume.
• Once re-enabled, the volume could again be decrypted and accessed.

5. Analyzed AWS KMS Activity with CloudTrail:

• Reviewed events like CreateGrant, Decrypt, and GenerateDataKeyWithoutPlaintext.
• Learned how CloudTrail provides audit-level visibility into every encryption-related action.

6. Enabled Key Rotation:

• Configured the automatic yearly rotation of the MyKMSKey to align with compliance best practices.

💡 Key Takeaways

• AWS automatically encrypts S3 objects using SSE-S3 by default — no configuration needed.
• Customer-managed keys (CMKs) in KMS offer more control, visibility, and security compliance.
• CloudTrail is crucial for auditing encryption and decryption activity in AWS.
• Disabling a KMS key immediately impacts any resource relying on it — a powerful security control.
• Key rotation helps reduce long-term exposure and maintains strong cryptographic hygiene.

🛡️ Final Thoughts

This lab deepened my understanding of how AWS integrates encryption at multiple layers — seamlessly combining S3, EBS, KMS, and CloudTrail to protect data in transit and at rest.
Data security isn’t just about storing information; it’s about ensuring confidentiality, integrity, and availability even under strict regulatory standards.

✅ Lab: Encrypting Data at Rest by Using AWS Encryption Options
📚 Focus Areas: AWS KMS | CloudTrail | S3 Encryption | EBS Encryption | Key Rotation
🧠 Role Context: DevOps Engineer | Cloud Security

🧩 GitHub Repo:🔐 Encrypting Data at Rest using AWS KMS, S3, and EBS

LinkedIn post: 🔐 Securing Data at Rest with AWS Encryption Tools