AWS Cloud Practitioner #13: Encryption y AWS KMS

Incidente: Laptop de empleado robada
Contenido: Database backup con 100K registros de clientes
Datos: Nombres, emails, SSN, tarjetas de crédito
 
Sin encryption:
❌ Ladrón accede archivo
❌ Lee todos los datos en plain text
❌ Data breach masivo
❌ Multas GDPR, pérdida de confianza
 
Con encryption:
✅ Archivo encriptado
✅ Sin encryption key = datos ilegibles
✅ No data breach
✅ Compliance mantenido

Plaintext: "Hello World"
        ↓ [Encryption con key]
Ciphertext: "X7#9mK$2pL@4"
        ↓ [Decryption con key]
Plaintext: "Hello World"
 
Sin key: Ciphertext es inútil

Ejemplos:
- S3 bucket con archivos
- EBS volume con database
- RDS database storage
- Snapshots/backups
 
Beneficio:
Si alguien accede storage físico → no puede leer datos

Ejemplos:
- HTTPS (TLS/SSL)
- VPN connections
- Data transfer entre services
 
Beneficio:
Si alguien intercepta network traffic → no puede leer datos

KMS gestiona:
✅ Key creation
✅ Key rotation
✅ Key policies (access control)
✅ Audit key usage (CloudTrail)
✅ FIPS 140-2 validated
 
Tú gestionas:
📌 Quién puede usar keys
📌 Qué services pueden usar keys
📌 Rotation schedule

Creadas y gestionadas automáticamente por AWS
 
Naming: aws/service-name
- aws/s3
- aws/rds
- aws/ebs
 
Características:
✅ Gratis
✅ Auto-rotación cada año
❌ NO puedes controlar key policy
❌ NO puedes deletear
 
Uso:
Default encryption para services

Creadas y gestionadas por TI
 
Características:
✅ Full control sobre key policy
✅ Puedes deletear
✅ Puedes disable
✅ Rotation configurable
💲 $1/mes por key
 
Uso:
Cuando necesitas control completo

Owned y managed por AWS internamente
 
Características:
✅ No ves en tu account
✅ Usadas por AWS services
✅ Gratis
❌ No control
 
Ejemplo: DynamoDB encryption por defecto

# Create customer managed key
aws kms create-key \
  --description "Production database encryption key"
 
# Output:
# KeyId: 1234abcd-12ab-34cd-56ef-1234567890ab
 
# Create alias (friendly name)
aws kms create-alias \
  --alias-name alias/prod-db-key \
  --target-key-id 1234abcd-12ab-34cd-56ef-1234567890ab
 
# Enable auto-rotation
aws kms enable-key-rotation \
  --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

1. SSE-S3 (AWS managed):
   - AWS gestiona keys
   - AES-256
   - Gratis
   - Header: x-amz-server-side-encryption: AES256
 
2. SSE-KMS (KMS managed):
   - Usa KMS keys
   - Audit trail (CloudTrail)
   - Control de acceso granular
   - Costo: KMS API calls
   - Header: x-amz-server-side-encryption: aws:kms
 
3. SSE-C (Customer provided):
   - Tú provees key en cada request
   - AWS NO almacena key
   - Tú gestionas keys completamente
   - Más complejo
 
4. Client-Side Encryption:
   - Encriptas ANTES de upload
   - AWS solo almacena ciphertext
   - Máxima seguridad

# Default bucket encryption (SSE-S3)
aws s3api put-bucket-encryption \
  --bucket mi-bucket \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "AES256"
      }
    }]
  }'
 
# SSE-KMS con customer managed key
aws s3api put-bucket-encryption \
  --bucket mi-bucket \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"
      }
    }]
  }'
 
# Forzar encryption (bucket policy)
{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyUnencryptedObjectUploads",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::mi-bucket/*",
    "Condition": {
      "StringNotEquals": {
        "s3:x-amz-server-side-encryption": "aws:kms"
      }
    }
  }]
}

EBS volumes pueden ser encriptados:
 
Características:
✅ Encryption at rest
✅ Data en disco encriptado
✅ Snapshots encriptados automáticamente
✅ Data in transit (EC2 ↔ EBS) encriptado
✅ Usa KMS keys
✅ No impact en performance
 
Limitación:
⚠️ Solo puedes enable encryption al crear volume
⚠️ Volumes existentes: Create snapshot → copy encrypted → restore

# Create encrypted EBS volume
aws ec2 create-volume \
  --availability-zone us-east-1a \
  --size 100 \
  --volume-type gp3 \
  --encrypted \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd
 
# Encrypt existing volume:
# 1. Create snapshot
aws ec2 create-snapshot \
  --volume-id vol-1234567890abcdef0 \
  --description "Backup before encryption"
 
# 2. Copy snapshot con encryption
aws ec2 copy-snapshot \
  --source-snapshot-id snap-1234567890abcdef0 \
  --encrypted \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd
 
# 3. Create volume from encrypted snapshot
aws ec2 create-volume \
  --snapshot-id snap-0987654321fedcba0 \
  --availability-zone us-east-1a

# Habilita encryption por defecto para región
aws ec2 enable-ebs-encryption-by-default
 
# Ahora todos los nuevos volumes son encrypted automáticamente

RDS databases pueden ser encriptados:
 
Encryption at rest:
✅ Database storage encrypted
✅ Automated backups encrypted
✅ Read replicas encrypted
✅ Snapshots encrypted
✅ Usa KMS keys
 
Encryption in transit:
✅ SSL/TLS connections
 
Limitación:
⚠️ Solo enable encryption al crear DB
⚠️ No puedes encriptar DB existente directamente

# Create encrypted RDS
aws rds create-db-instance \
  --db-instance-identifier prod-db \
  --engine postgres \
  --storage-encrypted \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd
 
# Encrypt existing DB:
# 1. Snapshot
aws rds create-db-snapshot \
  --db-instance-identifier prod-db \
  --db-snapshot-identifier prod-db-snapshot
 
# 2. Copy snapshot con encryption
aws rds copy-db-snapshot \
  --source-db-snapshot-identifier prod-db-snapshot \
  --target-db-snapshot-identifier prod-db-encrypted-snapshot \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd
 
# 3. Restore from encrypted snapshot
aws rds restore-db-instance-from-db-snapshot \
  --db-instance-identifier prod-db-encrypted \
  --db-snapshot-identifier prod-db-encrypted-snapshot

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM policies",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow use by EC2 role",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/EC2-Role"
      },
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Allow RDS to use key",
      "Effect": "Allow",
      "Principal": {
        "Service": "rds.amazonaws.com"
      },
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*"
    }
  ]
}

Use cases:
- HTTPS para websites
- Load Balancer SSL termination
- CloudFront distributions
- API Gateway
 
Características:
✅ Certificates gratis
✅ Auto-renewal
✅ Integration con ELB, CloudFront, API Gateway
❌ Solo funciona con AWS services (no puedes download private key)

# Request certificate
aws acm request-certificate \
  --domain-name www.miempresa.com \
  --subject-alternative-names miempresa.com *.miempresa.com \
  --validation-method DNS
 
# Output: CertificateArn
 
# Validate via DNS:
# ACM provee CNAME record
# Agregas a DNS provider (Route 53, GoDaddy, etc.)
# ACM verifica ownership → issues certificate
 
# Attach to Load Balancer
aws elbv2 create-listener \
  --load-balancer-arn arn:aws:elasticloadbalancing:... \
  --protocol HTTPS \
  --port 443 \
  --certificates CertificateArn=arn:aws:acm:...

vs. Hardcoding:
 
❌ Hardcoding:
const DB_PASSWORD = "MyPassword123!";
// Si código se filtra = password comprometido
 
✅ Secrets Manager:
const secret = await secretsManager.getSecretValue({
  SecretId: "prod/db/password"
}).promise();
const DB_PASSWORD = JSON.parse(secret.SecretString).password;
 
Beneficios:
- Secrets encrypted at rest (KMS)
- Automatic rotation
- Audit access (CloudTrail)
- Fine-grained access control

# Create secret
aws secretsmanager create-secret \
  --name prod/db/password \
  --secret-string '{"username":"admin","password":"MySecurePassword123!"}'
 
# Retrieve secret
aws secretsmanager get-secret-value \
  --secret-id prod/db/password
 
# Enable automatic rotation
aws secretsmanager rotate-secret \
  --secret-id prod/db/password \
  --rotation-lambda-arn arn:aws:lambda:us-east-1:123456789012:function:SecretsManagerRotation \
  --rotation-rules AutomaticallyAfterDays=30

Flujo:
 
1. KMS genera Data Encryption Key (DEK)
   - Plaintext DEK
   - Encrypted DEK (encrypted con Customer Master Key)
 
2. Usa Plaintext DEK para encriptar data
   Plaintext data → [Encrypt con DEK] → Ciphertext data
 
3. Descarta Plaintext DEK
   Almacena: Ciphertext data + Encrypted DEK
 
4. Para decrypt:
   - Envía Encrypted DEK a KMS
   - KMS decrypt → Plaintext DEK
   - Usa Plaintext DEK para decrypt data
 
Beneficio:
- No envías large data a KMS
- Solo envías DEK (pequeño)
- Más eficiente
- KMS limits no se alcanza fácilmente

1. Enable encryption at rest:
   ✅ S3: Default bucket encryption
   ✅ EBS: Encryption by default
   ✅ RDS: Storage encrypted
   ✅ DynamoDB: Encryption at rest
 
2. Use encryption in transit:
   ✅ HTTPS/TLS (ACM certificates)
   ✅ VPN para site-to-site connections
   ✅ SSL para database connections
 
3. Key management:
   ✅ Use customer managed keys para sensitive data
   ✅ Enable key rotation
   ✅ Audit key usage (CloudTrail)
   ✅ Least privilege (key policies)
 
4. Secrets:
   ✅ Usa Secrets Manager (NO hardcode)
   ✅ Enable automatic rotation
   ✅ Audit secret access
 
5. Compliance:
   ✅ Encrypt data según industry requirements
      - PCI-DSS: Payment data
      - HIPAA: Health data
      - GDPR: Personal data