1. Data Protection Principles

Data protection on AWS covers two dimensions: protecting data at rest (stored) and data in transit (moving). AWS provides encryption services, key management, data classification, and access controls to protect data throughout its lifecycle.

Data Protection Rule Encrypt EVERYTHING. At rest: enable default encryption on every service (S3, EBS, RDS, DynamoDB, SQS, Kinesis, CloudWatch Logs). In transit: enforce TLS/HTTPS everywhere. Manage keys with KMS. Classify data with Macie. Control access with IAM + resource policies. This is the foundation of data protection on AWS.

2. Encryption at Rest — Complete Service Map

Important Warning EBS and RDS encryption CANNOT be enabled on existing unencrypted resources. You must: 1) create a snapshot, 2) Copy the snapshot with encryption enabled, 3) restore/create a new resource from the encrypted snapshot. This is one of the most tested encryption topics on the exam.

3. Encryption in Transit

S3 Encryption Options SSE-S3: AWS manages the key, simplest, and default. SSE-KMS: you control key (audit, rotation, policy). Cross-account sharing requires CMK. SSE-C: You provide a key per request (AWS does NOT store the key). Client-Side: You encrypt before upload, maximum control. Exam: "cross-account S3 access" often requires SSE-KMS CMK with key policy granting the other account.

4. Key Management Deep Dive

KMS Key Hierarchy (Envelope Encryption):

  Customer Master Key (CMK) in KMS
       |
  Generate Data Key (GenerateDataKey API)
       |
  Plaintext Data Key         Encrypted Data Key
  (used to encrypt data)     (stored with encrypted data)
       |
  Encrypt data with          Delete plaintext
  plaintext data key         data key from memory
       |
  Store: Encrypted Data + Encrypted Data Key

  Decrypt: KMS decrypts the data key → use data key to decrypt data.
  CMK never leaves KMS. Only data keys leave KMS.

5. Data Classification & Discovery

6. Data Residency & Privacy


  1. Data never leaves a Region unless you explicitly replicate it (S3 CRR, Aurora Global DB, etc.)
  2. AWS does NOT access your data. Shared Responsibility: AWS secures the cloud, you secure data IN the cloud.
  3. GDPR compliance: use eu-west-1 (Ireland) or eu-central-1 (Frankfurt). SCPs restrict Regions.
  4. Data residency SCPs: deny all actions in non-approved Regions to prevent data leaving the country
  5. AWS Artifact: download AWS compliance reports (SOC, ISO, PCI DSS, HIPAA BAA)
  6. AWS Nitro System: hypervisor with no operator access. AWS employees CANNOT access your data on Nitro instances.
SCP: Restrict to EU Regions Only

{
  "Effect": "Deny",
  "Action": "*",
  "Resource": "*",
  "Condition": {
    "StringNotEquals": {
      "aws:RequestedRegion": [
        "eu-west-1",
        "eu-central-1"
      ]
    }
  }
}
Exam Tip Data Protection: "Encrypt at rest" = KMS (SSE-KMS for control, SSE-S3 for simplest). "Encrypt in transit" = TLS/ACM. "Cross-account encryption" = CMK key policy. "FIPS 140-2 Level 3" = CloudHSM. "Keys outside AWS" = External Key Store (XKS). "Find PII in S3" = Macie. "Prevent deletion" = S3 Object Lock (WORM). "Data residency" = SCP restrict Regions. "Envelope encryption" = KMS GenerateDataKey. "Encrypt EBS after creation" = snapshot → copy encrypted → restore.