Security & Encryption — Deep Dive on 🏠

28. KMS

Mon, 01 Jan 0001 00:00:00 +0000

KMS (Key Management Service) — Deep Dive#

AWS Key Management Service (KMS) is a managed service that lets you create, control, and use cryptographic keys to protect your data. Its core purpose is simple: rather than managing raw encryption keys yourself — which is error-prone and operationally burdensome — KMS centralises key management, enforces access control via IAM and key policies, and maintains an audit trail through CloudTrail. Every call to KMS is logged, which makes it the default choice for encryption across nearly every AWS service.

29. Secrets Manager & SSM Parameter Store

Mon, 01 Jan 0001 00:00:00 +0000

Secrets Manager & SSM Parameter Store#

Applications constantly need access to sensitive configuration: database passwords, API keys, OAuth tokens, and feature flags. Hardcoding these into source code or environment variables is a well-known security risk. AWS provides two services to solve this: Secrets Manager for sensitive credentials that need lifecycle management (rotation, auditing, cross-account sharing), and SSM Parameter Store for general-purpose configuration storage, including secrets. Knowing which to reach for — and when — is a frequently tested decision on the DVA-C02 exam.

30. ACM / ACM Private CA

Mon, 01 Jan 0001 00:00:00 +0000

ACM / ACM Private CA#

TLS certificates are what enable HTTPS — they authenticate your server’s identity and encrypt traffic between clients and your application. Without them, browsers display security warnings and connections are unencrypted. The problem they solve sounds simple, but managing certificates manually is error-prone: you have to generate them, validate domain ownership, deploy them to the right services, and renew them before they expire (typically every 13 months). A missed renewal causes an outage. AWS Certificate Manager (ACM) 🔗 automates all of this — provisioning, validation, deployment, and renewal — at no cost for certificates used with supported AWS services.

31. Macie

Mon, 01 Jan 0001 00:00:00 +0000

Macie#

As applications grow, so does the amount of data they store in S3 — user uploads, logs, exports, backups. It becomes increasingly difficult to track whether any of that data contains sensitive information like names, email addresses, credit card numbers, or API keys. Amazon Macie exists to solve exactly this problem: it automatically scans S3 buckets using machine learning to detect sensitive and personally identifiable information (PII), and alerts you when it finds something — or when your bucket configurations expose data in risky ways.