ExamFinch.com My Study

Study guide

1.4 Encryption, KMS, and Secrets Management

Practice this exam

AWS Solutions Architect Associate SAA-C03

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Solutions Architect Associate (SAA-C03) Exam Study Strategies and Exam Tips for SAA-C03 The AWS Well-Architected Framework

2 Domain 1: Design Secure Architectures (30%)

1.1 IAM Fundamentals — Users, Groups, Roles, and Policies 1.2 AWS Organizations, SCPs, and Multi-Account Strategy 1.3 VPC Security — Security Groups, NACLs, and VPC Endpoints 1.4 Encryption, KMS, and Secrets Management 1.5 AWS WAF, Shield, and Network Firewall 1.6 GuardDuty, Inspector, Macie, and Security Hub 1.7 The Shared Responsibility Model for Solutions Architects 1.8 Data Protection, Compliance, and Audit Services

3 Domain 2: Design Resilient Architectures (26%)

2.1 Elastic Load Balancing (ELB) — ALB, NLB, and GWLB 2.2 EC2 Auto Scaling — Dynamic, Predictive, and Scheduled 2.3 Multi-AZ and Multi-Region Architectures 2.4 Disaster Recovery Strategies — RTO and RPO 2.5 Decoupling with SQS, SNS, and EventBridge 2.6 AWS Step Functions and Workflow Orchestration

4 Domain 3: Design High-Performing Architectures (24%)

3.1 EC2 Instance Types, Purchasing Options, and Placement Groups 3.2 Lambda, Serverless Compute, and Container Services 3.3 Amazon S3 - Storage Classes, Lifecycle, and Performance 3.4 Block and File Storage - EBS, EFS, and FSx 3.5 Database Services - RDS, Aurora, DynamoDB, and More 3.6 CloudFront, Route 53, and Global Accelerator 3.7 Data Ingestion and Transformation - Kinesis, Glue, and EMR

5 Domain 4: Design Cost-Optimized Architectures (20%)

4.1 Compute Cost Optimization — Right-Sizing, RIs, Savings Plans, and Spot 4.2 Storage Cost Optimization — S3 Tiers, EBS, and Data Transfer 4.3 Database Cost Optimization 4.4 AWS Cost Management and Monitoring Tools

6 VPC and Networking Deep Dive

5.1 VPC Architecture — Subnets, Route Tables, and Gateways 5.2 VPC Connectivity — Peering, Transit Gateway, and Direct Connect 5.3 Amazon API Gateway 5.4 CloudFormation and Infrastructure as Code 5.5 AWS PrivateLink and Endpoint Services

7 Migration, Transfer, and Hybrid Services

6.1 The 7 Rs of Cloud Migration 6.2 AWS Snow Family — Snowball Edge Devices 6.3 CloudWatch, CloudTrail, and AWS Config 6.4 Amazon Cognito and Identity Federation 6.5 AWS DataSync and Transfer Family

8 Serverless Architecture and Application Services

7.1 Serverless Architecture Patterns 7.2 Advanced SQS Patterns — DLQ, Backpressure, and FIFO 7.3 Analytics Services — Athena, OpenSearch, and QuickSight 7.4 Container Orchestration — ECS, EKS, and ECR

9 Advanced Topics and Exam Scenarios

8.1 Advanced IAM — Permission Boundaries, Federation, and Cross-Account 8.2 Caching Strategies and ElastiCache Patterns 8.3 Hybrid Architecture — DNS, Storage, and Compute 8.4 SAA-C03 Scenario Practice — Putting It All Together

1.4 Encryption, KMS, and Secrets Management

Key Takeaways Explain This Topic AI

AWS KMS manages encryption keys for data at rest and integrates with most AWS services for server-side encryption.

KMS keys are AWS owned, AWS managed (free, auto-rotated), or customer managed ($1/month, configurable rotation and policies).

S3 offers SSE-S3, SSE-KMS, and SSE-C; SSE-KMS adds a CloudTrail audit trail of key usage.

Data in transit is protected with TLS; AWS Certificate Manager (ACM) issues free public certificates and auto-renews them.

Secrets Manager rotates database credentials automatically ($0.40/secret/month); Parameter Store is the cheaper option for plain configuration.

Last updated: October 2026

Quick Answer: Use KMS for encryption keys (data at rest), ACM for free TLS certificates (data in transit), Secrets Manager for rotating credentials, and Parameter Store for configuration. Encrypting your data is always the customer's job under the Shared Responsibility Model.

At Rest vs. In Transit

  • Type Protects Mechanism Services
  • At rest Stored data KMS keys / SSE S3, EBS, RDS, DynamoDB, EFS
  • In transit Data on the wire TLS/SSL ALB, CloudFront, API Gateway, ACM
  • AWS Key Management Service (KMS)

AWS KMS creates and controls symmetric and asymmetric keys used by nearly every AWS service. Keys never leave KMS in plaintext, and KMS hardware is FIPS 140-2 validated .

  • Key Type Managed By Rotation Cost
  • AWS owned AWS (shared, invisible) AWS-controlled Free
  • AWS managed ( aws/s3 , aws/ebs ) AWS, per service Automatic, yearly Free monthly; per-call charges

Customer managed (CMK) You Optional, configurable (yearly auto-rotate available) $1/month + ~$0.03 / 10,000 calls

Choose a customer managed key when you need a custom key policy , cross-account key sharing, an explicit rotation schedule, or fine-grained CloudTrail audit of key usage.

Key Policies

Every KMS key has a key policy — a resource-based policy. The default policy gives the account root the ability to delegate via IAM. Effective access requires the key policy AND (for IAM principals) an IAM policy permitting kms:Decrypt / kms:GenerateDataKey .

Envelope Encryption (high-yield)

KMS can directly encrypt only data up to 4 KB . For anything larger it uses envelope encryption :

Call GenerateDataKey → KMS returns a plaintext data encryption key (DEK) plus an encrypted copy.

Encrypt the data locally with the plaintext DEK.

Discard the plaintext DEK; store the encrypted DEK beside the ciphertext.

To read, KMS decrypts the DEK, which then decrypts the data.

Multi-Region keys replicate a key (same key material/ID) across Regions so you can decrypt in a disaster-recovery Region.

S3, EBS, and RDS Encryption

  • S3 Option Key Management Notable Point
  • SSE-S3 AWS-managed AES-256 Default on all new objects since 2023
  • SSE-KMS KMS key you pick CloudTrail audit trail of key use
  • SSE-C You supply the key per request AWS never stores the key
  • Client-side You encrypt before upload AWS sees only ciphertext

EBS: AES-256; encrypts volume, snapshots, and instance-to-volume traffic. You cannot encrypt an existing volume in place — snapshot it, copy the snapshot with encryption, then restore.

RDS: encryption is set at creation only ; read replicas inherit encryption; force TLS in transit with the rds.force_ssl parameter.

ACM, Secrets Manager, and Parameter Store

AWS Certificate Manager (ACM) issues free public TLS certificates and auto-renews them, integrating with ALB, CloudFront, API Gateway, and Elastic Beanstalk. Standard public ACM certificates can't be exported, but ACM exportable public certificates (an additional charge) can be deployed on EC2 instances, containers, and on-premises hosts. For integrated services, terminate TLS on an ALB or CloudFront with a free ACM certificate. Private CAs cost about $400/month.

  • Feature Secrets Manager Parameter Store (SSM)
  • Cost $0.40/secret/month + $0.05/10k calls Free (Standard, ≤10k params)
  • Rotation Built-in Lambda rotation (RDS, Redshift, DocumentDB) None native
  • Encryption Always KMS Optional KMS (SecureString)
  • Size limit 64 KB 4 KB Standard / 8 KB Advanced
  • Best for DB passwords, API keys Config flags, ARNs

On the Exam: "Automatically rotate RDS credentials" → Secrets Manager . "Store cheap configuration values" → Parameter Store . "Audit who used the encryption key" → SSE-KMS .

KMS Access Control: Two Gates

A frequent source of confusion is that using a customer managed key requires two approvals to line up. The KMS key policy (resource-based) must permit the principal, AND for IAM principals their IAM policy must permit the KMS action. If either gate is missing, decryption fails with an access-denied error even though the data is otherwise fine. This is why "the application can read the S3 object metadata but gets AccessDenied on the encrypted body" usually means the execution role lacks kms:Decrypt on the key, or the key policy never delegated to IAM.

The fix is to grant the role kms:Decrypt / kms:GenerateDataKey and ensure the key policy allows it.

Choosing an S3 Encryption Mode (decision guide)

  • If the requirement is… Choose
  • Encryption with zero key management overhead SSE-S3
  • Audit trail of key usage, key rotation control, or cross-account key sharing SSE-KMS
  • You must control and retain the keys outside AWS, supplied per request SSE-C
  • Data must be encrypted before it ever reaches AWS Client-side

Watch for the SSE-KMS throttling trap: high-volume S3 reads each trigger a KMS call and can hit account KMS request limits. The fix is S3 Bucket Keys , which reduce KMS calls by deriving short-lived bucket-level keys, cutting cost and avoiding throttling — a known SAA-C03 wrinkle.

Encryption in Transit Beyond ACM

While ACM handles public TLS termination at ALB/CloudFront, architects must also remember service-specific in-transit controls: RDS uses rds.force_ssl ; Amazon Redshift uses require_ssl ; S3 can deny non-HTTPS access with a bucket policy condition on aws:SecureTransport ; and a VPN or Direct Connect with MACsec protects on-premises-to-AWS links. The exam may pair "all data in transit must be encrypted" with "reject plain HTTP requests to the bucket" — the answer is an S3 bucket policy denying requests where aws:SecureTransport is false .

Common Trap: a standard (free) ACM public certificate cannot be installed on EC2 — terminate TLS on a CloudFront distribution or load balancer. To run TLS on the instance itself, use an ACM exportable public certificate (an additional charge), an AWS Private CA certificate, or an imported third-party certificate.