Cloud Encryption at Rest and in Transit

Try it out loud first. Then check yourself:

1. At rest, the provider encrypts disks and storage, often by default; in transit, TLS protects data moving over networks.
2. Provider-managed keys are easy; customer-managed keys let you control access, rotation and disabling, and see key use in logs.
3. Encryption at rest protects against stolen disks, not against someone with valid permissions reading through the API.
4. Most cloud data leaks are permission mistakes, so access control and logging matter more than the encryption setting.

If the interviewer pushes back

• When is it worth paying for and managing customer-managed keys instead of the default?

Go deeper

• docs.aws.amazon.com/kms/latest/developerguide/overview.html