this post was submitted on 08 Jun 2024
17 points (100.0% liked)
Learn Programming
1638 readers
1 users here now
Posting Etiquette
-
Ask the main part of your question in the title. This should be concise but informative.
-
Provide everything up front. Don't make people fish for more details in the comments. Provide background information and examples.
-
Be present for follow up questions. Don't ask for help and run away. Stick around to answer questions and provide more details.
-
Ask about the problem you're trying to solve. Don't focus too much on debugging your exact solution, as you may be going down the wrong path. Include as much information as you can about what you ultimately are trying to achieve. See more on this here: https://xyproblem.info/
Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Yes, AWS uses KMS - by default everything like RDS is encrypted at rest through the AWS default KMS key (default for your account, not globally default). I'm still not entirely sure what the point is, since once you login to the AWS console, or connect to the database, everything is decrypted by default anyways. So I suppose the main thing it protects from is physical access.
You can make it more complicated by having more complicated KMS schemes, for example, see Demystifying KMS keys operations - That has a pretty good explanation of what KMS is, and the point of encrypted at rest (at AWS).
A reason customers could ask for encryption at rest could be that they want to be in control of the decryption key. Then at any point that would give them the ability to revoke the decryption key, and practically revoke your access to their data
But as @recursive_recursion mentioned, you should probably ask the stakeholder what the point is. 90% of the time the point is just some checkbox on a ISO27001 or SOC2 form. And "really providing any extra security" is not
Yes, that's about it AFAICT. Like if a service disposes of their disks incorrectly it shouldn't expose the data.