Encryption in the Cloud
Encryption transforms readable data into ciphertext, making it useless without the right key. In cloud computing, encryption is everywhere — at rest, in transit, and sometimes in use. It's the single most important control for protecting data.
Encryption at Rest vs In Transit
┌─────────────────────────────────────────────────────────┐
│ ENCRYPTION OVERVIEW │
│ │
│ DATA AT REST DATA IN TRANSIT │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ Stored on │ │ Moving │ │
│ │ disk, S3, │ │ across │ │
│ │ database │ │ network │ │
│ └──────┬───────┘ └──────┬───────┘ │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ AES-256 │ │ TLS 1.2/1.3 │ │
│ │ Server-Side │ │ HTTPS, VPN │ │
│ │ Encryption │ │ IPSec │ │
│ │ (SSE-S3, │ │ │ │
│ │ SSE-KMS, │ │ Certificates│ │
│ │ SSE-C) │ │ & Keys │ │
│ └──────────────┘ └──────────────┘ │
│ │
│ DATA IN USE (Advanced) │
│ ┌──────────────────────────────────────────────┐ │
│ │ Confidential Computing │ │
│ │ Encrypted memory, secure enclaves │ │
│ │ (AWS Nitro Enclaves, Azure Confidential) │ │
│ └──────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────┘
Key Management Service (KMS)
KMS is a managed service for creating and controlling encryption keys. Instead of managing keys yourself, the cloud provider handles the hard part — key storage, rotation, and auditing. You just tell it what to encrypt and who can use the key.
┌─────────────────────────────────────────────────┐
│ KMS WORKFLOW │
│ │
│ ┌───────────┐ ┌───────────┐ │
│ │ Your App │───▶│ KMS │ │
│ │ │ │ │ │
│ │ "Encrypt │ │ Master Key│ │
│ │ this │ │ (CMK) │ │
│ │ data" │ │ │ │
│ └───────────┘ └─────┬─────┘ │
│ │ │
│ ┌──────────┴──────────┐ │
│ ▼ ▼ │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ Data Key │ │ Encrypted │ │
│ │ (DEK) │ │ Output │ │
│ │ generated │ │ returned │ │
│ └──────┬───────┘ └──────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────┐ │
│ │ Encrypt data │ │
│ │ with DEK │ │
│ │ Store DEK │ │
│ │ alongside data │ │
│ └──────────────────┘ │
└─────────────────────────────────────────────────┘
TLS/SSL for Secure Communication
TLS (Transport Layer Security) encrypts data moving between clients and servers. When you see HTTPS in the browser, that's TLS at work. In the cloud, you'll use TLS for API calls, load balancers, and service-to-service communication.
Client Server
│ │
│──── ClientHello ──────────▶│ "I support TLS 1.3"
│ │
│◀─── ServerHello ───────────│ "Let's use AES-256-GCM"
│◀─── Certificate ───────────│ "Here's my identity"
│──── Key Exchange ─────────▶│ "Shared secret"
│ │
│◀═══ Encrypted Traffic ═════▶│ All data now encrypted
Key Management Strategies
┌────────────────────────────────────────────────┐
│ KEY MANAGEMENT OPTIONS │
│ │
│ Cloud-Managed Customer-Managed │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ AWS S3 SSE-S3│ │ AWS KMS CMK │ │
│ │ AWS handles │ │ You control │ │
│ │ everything │ │ rotation, │ │
│ │ │ │ policies, │ │
│ │ Easiest but │ │ access │ │
│ │ least control│ │ │ │
│ └──────────────┘ └──────────────┘ │
│ │
│ Bring Your Own Key Cloud HSM │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ Import your │ │ Dedicated │ │
│ │ own keys │ │ hardware │ │
│ │ into cloud │ │ security │ │
│ │ KMS │ │ module │ │
│ │ │ │ │ │
│ │ Maximum │ │ FIPS 140-2 │ │
│ │ control │ │ Level 3 │ │
│ └──────────────┘ └──────────────┘ │
└────────────────────────────────────────────────┘
Encryption Best Practices
1. Enable default encryption on all storage (S3, EBS, RDS)
Never rely on application-level encryption alone.
2. Use customer-managed keys (CMK) for sensitive data
Gives you control over who can decrypt and when.
3. Rotate keys regularly
Most KMS services support automatic annual rotation.
4. Separate keys from data
Store encrypted DEKs with data, keep CMK in KMS only.
5. Enable key usage logging
CloudTrail tracks every encrypt/decrypt call.
6. Use envelope encryption
Encrypt data with a DEK, encrypt the DEK with CMK.
Faster for large datasets.