AWS Landscape 21: Encryption

Data security and regulatory compliance are critical for SAP workloads in AWS. Encryption at rest ensures that all sensitive data stored in EC2, EBS, S3, EFS, and backups is protected against unauthorized access. AWS Key Management Service (KMS) provides a centralized, secure, and auditable method for managing encryption keys, including automatic rotation, fine-grained access control, and regional key separation.

Objective:

• Protect all data at rest across AWS resources.
• Use KMS Customer Managed Keys (CMKs) per region and security zone for fine-grained access control.
• Enforce automatic key rotation for cryptographic hygiene.
• Ensure compliance with regulations such as GDPR, HIPAA, and internal security standards.

Scope of Encryption:

• EBS Volumes: Default encryption using KMS CMKs.
• S3 Buckets: Server-Side Encryption (SSE-KMS) for all objects.
• EFS: Encryption at rest enabled during file system creation.
• Backups & Snapshots: Encrypted automatically via KMS CMKs.

Key Management:

• Use CMKs per region or security zone to isolate access and meet compliance requirements.
• Limit access using IAM policies and key policies to authorized users and roles.
• Enable automatic yearly key rotation for all CMKs.

Compliance Benefits:

• Ensures data confidentiality across the SAP landscape.
• Supports least privilege access for administrators and workloads.
• Integrates with AWS Backup, EFS, and S3 for consistent encryption across resources.

Technical Steps for Encryption

Step 1: Create KMS CMKs
Navigate to AWS KMS → Create Key → Symmetric Key.
Configure:

• Key usage: Encrypt/Decrypt
• Key policy: Restrict access to specific AWS accounts, IAM roles, and services.
• Automatic rotation: Enable yearly rotation.

Step 2: Enable EBS Encryption

• When creating new EBS volumes, select Encrypt this volume and choose the CMK.
• Optionally, set default EBS encryption at the account level to automatically encrypt all new volumes.

Step 3: Enable S3 Encryption

• Navigate to S3 → Bucket → Properties → Default encryption.
• Select SSE-KMS and associate with the CMK.
• All new objects uploaded to the bucket are automatically encrypted.

Step 4: Enable EFS Encryption

• Enable encryption at rest during EFS creation.
• Choose the CMK (can be the same as EBS/S3 or a separate key per environment).

Step 5: Backup & Snapshot Encryption

• AWS Backup and snapshots automatically use KMS CMKs for encryption.
• Verify encryption policies in Backup plans to ensure compliance.

Step 6: Access Control
Only authorized IAM roles can:

• Encrypt/decrypt EBS volumes or EFS file systems.
• Access S3 objects encrypted with the CMK.
• Manage KMS keys.
• Enforce least privilege principle and maintain audit trails.

Encryption Flow Diagram:

SAP Workloads

│

├─> EC2 EBS Volumes ─┐

│                    │

├─> S3 Buckets (SSE) ├─[Encrypted APIs/NFS]──> EFS File Systems ─┐

│                    │                                           │

└─> AWS Backups ─────┘                                           │

                                                                 │

                                            AES-256              │

                                            Encrypt/Decrypt      ▼

                                                       ┌─────────────────────┐

                                                       │  KMS CMK            │

                                                       │  • Auto yearly rot. │

                                                       │  • Per-region keys  │

                                    IAM Roles ─────────┼─ Key Policies ──────┼─► CloudTrail Audit

                                                       │  • Least privilege  │

                                                       └─────────────────────┘

                                                                  │

                                                    Compliance: GDPR/HIPAA/PCI-DSS

                                                

Key Security Features:

Encryption Type         ---> AES-256 via KMS

Key Type ---> Customer Managed Keys (CMK)

Rotation ---> Automatic yearly rotation

Access Control ---> IAM + Key Policies

Audit         ---> AWS CloudTrail

Compliance Benefits:

Supports GDPR

Supports HIPAA

Protects SAP sensitive business data

Provides auditable encryption management