Data Protection

KMS and envelope encryption, TLS everywhere, immutability, secrets — 18%

• KMS, Keys, and Certificates — The cryptographic foundation: envelope encryption and encryption context, the three key types and the key policy that is the root of a key’s authority, grants and kms:ViaService, multi-Region keys, CloudHSM and external key stores, imported key material, and certificates from ACM and Private CA. (5 lessons, 70 min)
• Protecting Data in Transit — Making encryption on the wire non-optional: ELB security policies and TLS termination choices, explicit denies on aws:SecureTransport, PrivateLink and VPC endpoints as private paths you can require, and inter-node encryption for EMR, EKS, SageMaker AI, and the Nitro System. (3 lessons, 60 min)
• Protecting Data at Rest — Every S3 encryption option and the requirement each one satisfies, the four-layer S3 access decision and how to troubleshoot it, Object Lock and Vault Lock for WORM and integrity, and encryption for EBS volumes, file systems, and databases — including the snapshot-sharing rules. (4 lessons, 65 min)
• Secrets, Masking, and Resilience — Credentials that rotate themselves, sensitive data masked in logs and messages before an operator can read it, backups that survive a compromised administrator, and lifecycle rules that retain data exactly as long as the obligation lasts — no longer. (4 lessons, 60 min)