Encryption keys, certificates, and data retention

Three questions about data

Data security controls usually come down to three questions:

1. Who controls the keys that encrypt the data at restEncryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entryClose?
2. Is the data encrypted in transit, and will that keep working?
3. Can the data be deleted or changed before it should be?

This tutorial covers the AWS services that answer each one.

AWS KMS key types

AWS Key Management Service (AWS KMS) offers three types of keys. The difference between them is how much control and visibility you have.

	Customer managed key	AWS managed key	AWS owned key
Lives in	Your account	Your account	An AWS service account
Key policy	You control it	Controlled by the service; you can view it	Not visible to you
Use logged in your CloudTrail	Yes	Yes	No
Rotation	Optional, you choose	Automatic, every year	Managed by the service
Cost	Monthly fee plus usage	No monthly fee; usage charges can apply	No charge

AWS managed keys have aliases such as aws/s3 or aws/ebs. You can audit their use, but you cannot change their key policies, rotate them yourself, or delete them.

Choose a customer managed keyCustomer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entryClose when you must decide who can use the key through its key policy, control its rotation, or share encrypted resources with other accounts.

Encrypting S3 data at rest

Every S3 bucket has default encryption: since January 5, 2023, Amazon S3 encrypts all new objects at rest automatically. The server-side encryptionSSE (Server-side encryption)Encryption that a service applies when it stores your data and removes when you read it back. Amazon S3 encrypts every new object with SSE-S3 by default; SSE-KMS uses keys in AWS KMS instead.Glossary entryClose options differ in who manages the key:

• SSE-S3 is the default. It uses keys that Amazon S3 manages. It is simple, but there is no key policy for you to control.
• SSE-KMS uses an AWS KMS key. You can choose the AWS managed key for S3 (aws/s3) or a customer managed key.
• DSSE-KMS applies two independent layers of encryption with an AWS KMS key, for requirements that call for multilayer encryption.
• SSE-C uses a key that you supply with each request. Since April 2026, SSE-C is disabled by default for new general purpose buckets, so it must be turned on deliberately.

If a requirement says you must control who can use the key and audit each use, the answer is SSE-KMS with a customer managed key.

Encrypting data in transit

AWS Certificate Manager (ACM) issues TLSTLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entryClose certificates for use with integrated services such as Elastic Load Balancing and Amazon CloudFront. ACM can renew the certificates it issues:

• With DNSDNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entryClose validation, ACM renews eligible certificates automatically. A certificate is eligible when it is associated with another AWS service, such as Elastic Load Balancing or CloudFront, or has been exported.
• With email validation, ACM sends renewal notices by email, and someone must act on them before the certificate expires.
• Certificates you import from another certificate authorityCA (Certificate authority)A trusted organization or service that issues digital certificates, vouching that a public key belongs to a named domain or organization. Browsers trust certificates signed by well-known CAs; AWS Private CA issues certificates for internal use.Glossary entryClose are not eligible for managed renewal. You must renew and re-import them yourself.

For a public website behind an Application Load Balancer, request a public ACM certificate with DNS validation and attach it to an HTTPSHTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entryClose listener.

Preventing deletion: S3 Object Lock

S3 Object Lock stores objects using a write-once-read-many (WORMWORM (Write once, read many)A storage model in which data can be written once and then cannot be changed or deleted for a set period, often to meet record-keeping rules. Amazon S3 Object Lock and AWS Backup Vault Lock provide it.Glossary entryClose) model. It works only in buckets with S3 Versioning enabled, and it protects individual object versions.

Object Lock offers two retention modes:

• Compliance mode: no user, including the root user, can overwrite or delete a protected object version until its retention period ends. The retention mode cannot be changed and the period cannot be shortened.
• Governance mode: most users cannot delete protected versions, but users with the s3:BypassGovernanceRetention permission can override the retention settings.

A legal hold gives the same protection without an end date. It stays in place until someone with permission removes it.

How MFA delete differs

MFAMFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entryClose delete is a versioning setting that requires an MFA code to permanently delete an object version or change the bucket's versioning state. Only the bucket owner (the root user) can enable it. It adds friction, but the bucket owner can still delete versions by providing an MFA code. When a regulation says that nobody may delete records for a set period, use Object Lock in compliance mode.

Key takeaways

• Customer managed KMS keys give you full control of the key policy; AWS managed keys can be audited but not changed.
• SSE-KMS with a customer managed key meets "control and audit the key" requirements for S3.
• ACM renews the certificates it issues when they use DNS validation; imported certificates are your responsibility.
• Object Lock compliance mode is the only option here that stops even the root user from deleting data early.

Sources

• AWS KMS Developer Guide: AWS KMS keys
• Amazon S3 User Guide: Protecting data with server-side encryption
• Amazon S3 User Guide: Using SSE-KMS
• AWS Certificate Manager User Guide: Managed certificate renewal
• Amazon S3 User Guide: Locking objects with Object Lock
• Amazon S3 User Guide: Configuring MFA delete