balamurugana/server-side-encryption-and-kms.md

## server-side-encryption-and-kms.md

      
    Raw
  

              server-side-encryption-and-kms.md
            
          
    Service Side Encryption (SSE) in AWS S3:

Three types of SSE supported.

SSE-C - client provides data encryption key for every get/put object calls.  AWS S3 does not store client provided data encryption key. Client provided data encryption key may be generated by AWS KMS for every get/put object calls.  It is user responsibility to securely save/map data encryption keys generated by KMS and AWS S3 does not store any data encryption key.
SSE-S3 - client does not provide any encryption key for any get/put object calls.  AWS S3 uses one single key (generated at first time) to encrypt/decrypt objects.  Accordingly AWS docs, this key is stored along with object data.
SSE-KMS - client provides Customer Master Key (CMK) for any get/put object calls.  AWS S3 uses client's provided CMK to generate data keys using KMS to encrypt/decrypt objects.  This data key is encrypted using KMS and is stored along with object data.

Below bucket policy prevents uploading unencrypted objects (even by owner/auth user).

SSE-KMS:

{
   "Version":"2012-10-17",
   "Id":"PutObjPolicy",
   "Statement":[{
         "Sid":"DenyUnEncryptedObjectUploads",
         "Effect":"Deny",
         "Principal":"*",
         "Action":"s3:PutObject",
         "Resource":"arn:aws:s3:::YourBucket/*",
         "Condition":{
            "StringNotEquals":{
               "s3:x-amz-server-side-encryption":"aws:kms"
            }
         }
      }
   ]
}

SSE-S3:

{
  "Version": "2012-10-17",
  "Id": "PutObjPolicy",
  "Statement": [
    {
      "Sid": "DenyIncorrectEncryptionHeader",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::YourBucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    },
    {
      "Sid": "DenyUnEncryptedObjectUploads",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::YourBucket/*",
      "Condition": {
        "Null": {
          "s3:x-amz-server-side-encryption": "true"
        }
      }
    }
  ]
}
AWS KMS:


KMS provides API to create Customer Master Key (CMK) which is not retrievable.
KMS provides APIs to encrypt/decrypt data of max. 4KiB size.
KMS provides APIs to generate data keys using CMK.
KMS is not a vault i.e. there is no way user generated keys (even data keys generated by KMS) are stored in KMS.
KMS uses HSMs underneath.
KMS is a general purpose key management service it can be hooked into any AWS services like S3 (or even services outside of AWS).

Hashicorp Vault:


In simple words, it is encrypted key/value store.
All keys/values are stored in vault.  It comes with default expiry time and sealing/unsealing.
It also provides ecnrypt/decrypt functions like AWS KMS.
By default, it is not HA and fault tolerance.  The recommendation is to use Consul as data store which provides HA and fault tolerance.

Azure Vault:


It is encrypted key/value store along with AWS KMS features.
It uses HSM to perform encrypt/decrypt operations.

Keywhiz:


It is same as Hashicorp Vault written in Java.

https://gist.github.com/maxvt/bb49a6c7243163b8120625fc8ae3f3cd is nice work of comparing various key management systems.