Encryption converts readable plaintext into ciphertext that can be recovered through decryption with the appropriate key. Its primary security benefit is confidentiality: someone who obtains an encrypted disk, backup, or network transmission should not be able to understand its contents without the necessary key. In cloud environments, managed encryption capabilities reduce the work required to protect data, but customers must still configure access controls and select protections appropriate to their workloads.
Encryption at rest protects stored data, including objects, database files, virtual machine volumes, snapshots, and backups. For example, an engineering team can encrypt a database and its backups so that access to underlying storage alone does not expose customer records. Encryption in transit protects data moving between systems, commonly through Transport Layer Security, or TLS. A web application should use HTTPS for browser traffic and separately protect connections between its application servers and database. Encrypting storage does not automatically encrypt these network connections.
Symmetric encryption uses the same secret key for encryption and decryption and is commonly used for large amounts of data. Asymmetric cryptography uses a mathematically related public and private key pair and supports functions such as secure key establishment and digital signatures. Engineers should use established protocols and supported cryptographic libraries rather than design their own encryption schemes.
Cloud services commonly use envelope encryption: a data key encrypts the data, and another key protects that data key. This allows services to handle large datasets efficiently while centralizing control over the keys that protect data keys. Key management includes controlling usage permissions, auditing operations, planning rotation, and ensuring that keys remain available for authorized recovery. Losing or deleting a required key can make otherwise healthy data unrecoverable. Rotating a key does not necessarily re-encrypt existing data.
Server-side encryption means the service encrypts data after receiving it and decrypts it for authorized requests. Client-side encryption means an application encrypts data before sending it to the service. Client-side encryption can limit the provider's access to plaintext, but it increases application complexity and can restrict server-side searching or processing. An authorized user may still receive plaintext from a server-side encrypted resource, so encryption does not replace identity policies or least-privilege access.
Encryption has operational trade-offs. Cryptographic processing, key-service requests, and key storage can introduce costs or latency. Key-service availability and permissions can affect application availability, so teams should test restore procedures and investigate decryption failures alongside ordinary access failures. Managed services simplify implementation, but defaults, key ownership options, and coverage differ between services.
For certification questions, distinguish confidentiality from other security goals. Encryption alone does not guarantee integrity, availability, regulatory compliance, or protection against an application that legitimately decrypts data and then exposes it. Authenticated encryption and correctly configured TLS add integrity protections, while backups and resilient architectures address availability. Hashing is not reversible encryption, and encoding such as Base64 provides no confidentiality. Under the shared responsibility model, AWS protects its underlying infrastructure while customers remain responsible for their data, permissions, and applicable encryption configuration.
Amazon S3
Amazon RDS