In this hands-on workshop, we use the AWS Cloud9 IDE to learn about data encryption services, such as AWS Key Management Service (KMS) and AWS Certificate Manager (ACM). We also explore various aspects of AWS KMS and AWS ACM private certificate authority.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Data encryption and certificate
management concepts in AWS
Ram Ramani
Solutions Architect, Security Specialist
AWS
F N D 3 0 2

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
AWS console access (requires hash code)
Workshop environment setup
Presentation on encryption
Hands-on Workshop 1: Server-side encryption
Presentation on certificate management
Hands-on Workshop 2: Private certificate authority (CA)
Q&A

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Workshops
Key workshop tools
• Python 2.7
• Python boto3 library
Key AWS services
• AWS Key Management Service (AWS
KMS)
• AWS Certificate Manager (ACM)
• AWS Cloud9 IDE
Region: us-east-2 (Ohio)

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Workshop GitHub page: https://bit.ly/2HunMm7
Console login: https://bit.ly/2W93MwS

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cloud encryption requirements
Access control to keys
Minimized key management burden
Ensured security of keys
Ensured durability of keys
API-driven encryption for automation

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Envelope encryption
Two-tiered key hierarchy using envelope
encryption
• Unique data key encrypts customer data
• AWS KMS master keys encrypt data keys
Benefits
• Limited risk of compromised data key
• Better performance for encrypting large data
• Easier to manage (small number of master keys vs.
billions of data keys)
• Centralized access and audit of key activity
Customer master
keys (CMKs)
Data Key 1
Amazon S3
object
Amazon EBS
volume
Amazon
Redshift cluster
Data Key 2 Data Key 3 Data Key 4
Custom
application
AWS KMS

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Master key generation and storage options in AWS
Your applications
AWS
services
Authentication
authorization
logging
Your on-
premises HSM
BYOK
Imported to
AWS KMS Native
AWS KMS
Shared HSM
AWS KMS
custom
key store
Your AWS
CloudHSM
cluster

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Plaintext
data
Server-side encryption in Amazon S3
Amazon S3
service
Encrypt process
1
Decrypt process
Encrypted
data in storage
Amazon S3
service
5
Encrypted data
key
6
Plaintext
data
Decrypt
8
Data key
7
Encrypted data
key
Data key
3
CMK
AWS KMS
Generate data key request
2
Encrypted
data in storage
Encrypt
4

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Server-side encryption: Instruct the AWS service to
encrypt data after you’ve uploaded it
Your
applications
in your data
center
Your encrypted data
in AWS servicesAWS SDK
Your application
in Amazon EC2
Your encrypted data
in AWS services
AWS
KMS
AWS Cloud
Corporate
data center
Data
Data

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Your encrypted data
in AWS services
Your
applications
in your data
center
Your key management
infrastructure in Amazon
EC2
AWS
encryption SDK
Your key management
infrastructure
Your application
in Amazon EC2
Your encrypted
data in AWS
services
AWS
KMS
AWS
CloudHSM
AWS Cloud
Data
Data
Client-side encryption: Encrypt data before you give it to
an AWS service
Corporate
data center

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Server-side encryption: https://bit.ly/2HLvYf8
20 minutes

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Workshop recap
Step 1
Create key with policy
Create alias
Step 2
Create bucket
Upload file and verify encryption
Download file and verify decryption
Step 3
Clean up: delete key and delete alias

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Server-side encryption: https://bit.ly/2HLvYf8
Workshop quiz
• Where in the Amazon S3 console do you see the encrypted status?
• Can you view the actual encrypted content of the file?
• Can you view the actual key material of the CMK?
• To give someone access to the encrypted file, what policies need to be
adjusted?
• Can you access the data key associated with the file?

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is a CA?
subject = {
'Country': 'US',
'Organization': 'My Org',
'OrganizationalUnit': 'My Dept',
'State': 'New York',
'CommonName': '*.myorg.biz',
'SerialNumber':'0DADDBAE7F',
'Locality': 'New York'
}
Certificate
Private and
public keys

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Why use SSL/TLS private certificates?
• Verifies that the intranet site is valid
• Enforces encryption in transit
• Provides full control over certificate hierarchy
• Controls validation period of certificates

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Accessing a private website in your intranet
VPC
VPC
Corporate
Data center
Website
Website
VPN
AWS Direct
Connect Users

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
The old way: How to generate and manage private
certificates
• Purchase and manage HSM
• Build and maintain private CA
• Implement certificate monitoring mechanism
• Manually create certificates and signing requests using OpenSSL commands
• Retrieve certificates from the CA
• Install certificates
• Maintain certificate expiration schedule
• Renew certificates before they expire

20. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
ACM Private CA (ACM PCA)
Managed private CA service that helps you easily and securely
manage the lifecycle of your private certificates

21. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
What can ACM PCA do for you?
• Create a private CA with a few clicks
• Issue private certificates with a few clicks
• Secure the certificate keys in a FIPS-validated HSM
• Deploy the certificate (as easy as making a selection from a pull-down menu)
• Automatically renew certificates
• Provide a centralized dashboard for certificate monitoring
• Provide integrated auditing with AWS CloudTrail
• Provide access control with AWS Identity and Access Management (IAM)

22. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
CA hierarchy in organizations
Root CA
Intermediate CA
Issuing CA
Certificates

23. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Certificate hierarchy for this workshop: pathlen = 0
Root CA
Subordinate CA
Self-signed CA
Subordinate
ACM PCA
Production Workshop
In production, a root CA should be managed by a dedicated security team

24. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon Route 53
Application
Load Balancer
AWS Lambda
AWS Cloud9
ACM Private CA
https://alb.workshop.com
192.168.0.70
Invoke
<html>…</html>
Certificate
Workshop: Using private certificates with a load balancer

25. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
25 minutes
Creating private certificates using ACM PCA:
https://bit.ly/2LZOmGQ

26. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Certificate management: https://bit.ly/2LZOmGQ
Workshop quiz
• What is the CA hierarchy used for?
• Can you use an intermediate CA to sign the ACM PCA?
• What is the advantage of using your organization’s root or intermediate
certificate to sign the ACM PCA?

27. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Workshop recap
• Step 1: Configure infrastructure (security group, AWS Lambda, AWS Cloud9,
Amazon EC2 host)
• Step 2: Create a subordinate PCA using ACM
• Step 3: Create a root CA
• Step 4: Sign subordinate PCA using the root CA
• Step 5: Import CA-signed certificate and certificate chain into ACM
• Step 6: Issue certificate for the alb.workshop.com private DNS domain, and add
the certificate to the application load balancer
• Steps 7 and 8: Validate the https requests, and ensure that the certificate
validation is successful
• Step 9: Clean up

28. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

29. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Ram Ramani
ramanira@amazon.com