Let's Encrypt Everything, Really Everything
summary
Key management is layered: a data key encrypts each object and is itself encrypted by a customer master key stored regionally in AWS KSM and HSM‑backed keys; GenerateDataKey returns both plaintext and ciphertext, Encrypt via KMS handles up to 4KB, and over 117 AWS services can delegate keys to KMS. Customers import on‑prem keys (example Moneta: >1M customers, ~3,000 staff). For single‑tenant FIPS 140‑2 Level 3 hardware use AWS CloudHSM (3,500 keys/module, cluster up to 32, 30k RSA/s). Secrets rotate in AWS Secret Manager.
AI-written summary · about
chapters (19)
- 0:00Introduction to encryption
- 1:30AWS Key Management Service basics
- 10:34Client-side encryption with KMS
- 15:41KMS key import feature
- 18:58Asymmetric keys in KMS
- 22:27KMS security and compliance
- 23:55CloudHSM for single-tenant keys
- 27:53AWS Encryption SDK overview
- 31:11AWS Secrets Manager for secrets
- 32:35Network encryption with TLS
- 34:05AWS Certificate Manager
- 35:49Storage encryption options
- 36:58VPC network encryption
- 38:03Cross-region encryption
- 39:13Physical network encryption
- 40:17Storage encryption recap
- 42:04Hardware encryption with Graviton 2
- 42:45Partner solutions for encryption
- 44:10Summary and Q&A
related talks
51mUsing Key Management Service for data protection
27mEncrypting 6 Petabytes of Customer Data with AWS KMS
58mUsing AWS data protection services for innovation and automation
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
20mUnderstanding the shared responsibility model and AWS KMS XKS
50mImprove data control for customers with AWS KMS
20mApplication Secret Management with AWS KMS
01h 00mBehind the scenes: AWS investments in security innovation