Cloud Security — AWS — Part 3

Implementing AWS Keys Management Services:

Why do we need encryption?

We need to encrypt data to protect its confidentiality and integrity, ensuring that only authorized users can access or modify it. Encryption transforms readable data into an unreadable format, making it useless to attackers or unauthorized parties who might intercept or steal it. This is especially important for sensitive information such as personal details, financial records, or business secrets, helping prevent data breaches, comply with regulations, and maintain trust.

[embed]List: Cloud Security - AWS | Curated by Aditya Kumar | Medium Cloud Security - AWS · 8 stories on Mediummedium.com

Two main methods to implement encryption at rest:

· Client-Side Encryption: Data is encrypted on the user’s device (client) before it is sent to the server. This means only the client holds the encryption keys, so even the server storing the data cannot read it unless the client shares the key.

o You encrypt your data and manage your own keys.

o Use KMS if required

· Server-Side Encryption: Data is sent to the server in plain text, and the server encrypts it before storing. The server manages the encryption keys and handles both encryption and decryption when needed.

o AWS encrypts your data and manages the key for you

o Most AWS services like S3, EBS, Redshift provide server-side Encryption using KMS behind the scenes

What is AWS KMS?

AWS Key Management Service (KMS) is a fully managed service that makes it easy to create, control, and manage encryption keys used to encrypt your data. It helps you securely generate, store, and control cryptographic keys used across AWS services and your applications, ensuring data protection and compliance. AWS KMS integrates with many AWS services for seamless encryption and supports key rotation, access control via IAM policies, and detailed logging for auditing.

Where can we find this KMS?

What is CMK?

Customer Master Key (CMK) is a logical representation of a master key in AWS Key Management Service (KMS). It is the primary encryption key you create, manage, and use to encrypt and decrypt data encryption keys (DEKs) or directly encrypt small amounts of data. CMKs can be either customer-managed (created and controlled by you) or AWS-managed (managed by AWS). They include metadata, key material, usage policies, and permissions that control how and by whom the key can be used.

In short:

o KMS is the service platform.

o CMK is the specific encryption key that KMS handles to encrypt, decrypt, and control access to data.

So, CMKs live inside KMS and are used by KMS to perform encryption operations securely.

How to Encrypt data?

1. KMS generates a plaintext data key and returns it along with an encrypted data key (encrypted by the CMK).

2. The plaintext data key is used locally to encrypt the actual data.

3. The encrypted data and encrypted data key are stored together.

4. When decrypting, the encrypted data key is sent back to KMS, which uses the CMK to decrypt it, returning the plaintext data key.

5. The plaintext data key then decrypts the actual data.

How to decrypt data?

1. The encrypted data key is retrieved from storage along with the encrypted data.

2. This encrypted data key is sent to AWS KMS, which uses the CMK to decrypt it and returns the plaintext data key.

3. The plaintext data key is then used locally to decrypt the actual data, restoring it to its original form.

Working with KMS:

Where can we find this KMS?

Following screen will appear:

Click on the “Create a key” button: following screen will appear.

Select the suitable option, and click on the next button, following screen will appear, fill it:

Click next, following screen will appear: select the admin.

When you click Next, following screen will appear:

When you click next, it will ask you to review the policy:

When you click on the Finish button, following confirmation will show:

Implementing AWS Key Management Services:

Steps:

Open the “Users” section in the IAM:

Click on “create user”: following screen will appear. Fill it accordingly, make sure to check mark the “Provide user access to the AWS Management Console — optional”

Click on the “next” button: following screen will appear, select the respective group.

Click on the “Next” button: following screen will appear. You may add the tag, and then click on the “Create User” button.

Following confirmation occurs:

Now, open the KMS:

Following screen will appear:

Click on the “create key” button: following screen will appear.

Select accordingly and click on the “next” button: following screen will appear.

Fill it accordingly:

Click on the “Next” button: select the admin name (user created)

Click on the “Next” button: again select the name.

Click on the “Next” button: review the key policy, as shown below.

Click on the “Next” button to open the review section as shown below:

Click on the “finish” button to create the key: following confirmation will occur.

You may check the properties of that key by clicking on it, following screen will appear:

Now, click open the “S3”

Following screen will appear:

Click on the “Create Bucket” option: following screen will appear.

Keep everything as default and then click on the ‘Create bucket’ button at the bottom: following confirmation will occur.

Open that bucket:

Go to the “properties” section and click on the edit button at the “bucket versioning” section:

Click on the “Enable” radio button: click on the save changes.

Under the “Properties” section, scroll down and reach the “Default Encryption” section:

Click on the “edit” button: following options will appear.

Under the “encryption type” select the “Server-side encryption with AWS Key Management Service keys (SSE-KMS)”: also specify the AWS KMS key ARN. Then click on the “Save changes” button.

Now, open the ‘Server access logging’ section:

Click on the “edit” button: following screen will appear.

Click on the “enable” button: screen changes to this.

Click on the “Browse S3” button: select the Bucket.

And done!

Creating secure EC2 Instances in AWS Virtual Private Cloud (VPC):

Steps:

To create the VPC, first open the VPC:

Following window will appear:

Under the “Your VPC” section: click on “Create VPC” button

Following screen will appear:

Fill the name, CIDR, don’t change any other settings: then click on the “Create VPC” button.

Following confirmation will occurs:

Now, we need to create an Internet Gateway:

Following screen will appear:

Click on the “Create Internet Gateway” Button: following screen will appear.

Fill it and rest of the things be default, and then click on “Create Internet Gateway” button:

Following confirmation will show:

At the green confirmation, click on the “Attach to a VPC” button:

Following window will appear:

Select the required VPC: and then click on “Attach Internet Gateway” button, following confirmation will occur.

Make sure that it shows “attached”:

Next, we need to create private and public subnet in the VPC, to do so click on the “subnet” option available on the left menu:

Following screen will appear:

First, we will create a private subnet: click on the “Create subnet” button, following screen will appear.

Select the VPC ID, and assign the name:

Scroll down and make sure to write the “IPV4 subnet CIDR block”:

Leave rest of the settings as it is, and then click on the “create subnet” button: following confirmation will occur.

So a private subnet is created, now we need to create a public subnet.

For this, again click on the “Create subnet” button:

Again, do the same process we did above, just make sure to specify the different subnet block.

Click on the “create subnet” button, following confirmation will occur.

Thus, we have two subnets for private and public access. Next, we will create the route tables to route the network traffic: where to find this route table?

Following screen will appear:

To create a route table for the public subnet, click on the “Create route table” button: following screen will appear.

Fill the details and then click on the orange button:

Following confirmation will occur:

Go back to the section of “Route Tables”, make sure to edit the name of default route table created or the VPC to identify the private route table:

Now, we will configure the public route table as public and add the public subnet and internet gateway. Click on the public route table: and click on the “routes” section.

Click on the “Edit Routes” button: following screen will appear

Click on “add route” button to add the IP: write 0.0.0.0/0 for allowing traffic from any source, and then select the Internet gateway option from the target section.

Click on “save changes” button: following confirmation will occur.

Now, again select the public route table and then go to the “Subnet association” section:

Click on the “Edit subnet association” button: following window will appear

Select the subnet for public association:

Click on the “Save association” button: following confirmation will occur.

Clearly the association is added successfully:

Now, we will add the subnet for the private route table:

Then,

Following confirmation will occur:

Now, we will configure the traffic from the internet, using the “Security Groups” section: following window will occur.

We can actually see the default security group created for our VPC:

Edit its name:

Now, we will configure the inbound traffic for that security group:

Click on the “Edit Inbound rules” button: following screen will appear.

Click on “add rule” button, and select the type as “All traffic” , and in source “My IP” to make sure only your IP can access.

Then click on the “save rules” button: following confirmation will occur.

So, inbound rules is set for the Security groups. Now, open the ACL:

Identify the default Network ACL:

Change its name:

Next, click on the “Inbound rule” section: clearly all the traffic is allowed, but we need only traffic from our IP.

Click on the “Edit Inbound rules” button: following screen will appear.

Specify your IP, in the Source:

Click on the Save changes button: following confirmation will occur.

So, till now, ACL is also configured properly. Now, we will move towards the EC2 Instance creation:

Following screen will appear:

Click on launch instance button: following screen appears.

Scroll down, keep other things as it is, just make the following changes in the “network settings” section:

Click on “launch instance” button: following confirmation will occur.

We may recheck the status of the instance here:

Click on the instance and note the Public IP address:

Now, we will create another instance for the private subnet: click on “launch instance” button again. For this new instance, keep things as default, just change the “network settings” section as:

Then click on the “Launch instance” button: clearly “my-test-private” is created.

We can also see the details of the private instance :

Now, we will check if we are able to achieve our goal or not, for which we will ping the Public IP of the non-private instance: clearly it is working.

Similarly, pinging private instance will not work:

What is a Cloud Application?

A cloud application is internet-based software deployed in a cloud environment, accessed through browsers or APIs. Data and processing are handled by remote cloud servers, while users interact via web or mobile interfaces. Examples: Google Docs, Microsoft 365.

Deployment Models:

1. Public Cloud — Services open to anyone. Advantages: cost-efficient, scalable, reliable, no maintenance.

2. Private Cloud — Used by a single organization, stays behind a firewall. Advantages: secure, flexible, controlled, scalable.

3. Hybrid Cloud — Mix of public + private. Advantages: balance of control, flexibility, and cost-efficiency.

Advantages of Cloud Applications:

· Reliability: High availability, disaster recovery.

· Scalability: Dynamic, instant scaling.

· Cost Efficiency: Pay-as-you-go, no infrastructure investment.

· Ease of Management: Cloud Management Platforms (CMPs) via APIs.

· Security & Data Sharing: Centralized, backed-up, world-class protections.

· APIs: Enable integration and predictable development.

· Agility: Faster updates, testing, and response to business needs.

Disadvantages:

· Security Risks: Continuous monitoring needed.

· Downtime: Dependent on internet & provider outages.

· Lack of Control: CSP owns/operates infrastructure.

Security Benefits of Cloud Applications:

· High Baseline Security: Providers meet regulatory & compliance standards.

· Responsiveness: APIs/automation enable quick security updates (e.g., firewall rules).

· Isolated Environment: Virtual networks prevent lateral attacks.

· Independent VMs: Microservices reduce attack surface.

· Elasticity: Autoscaling with immutable servers reduces admin risks.

· DevOps Security: Automation strengthens code hardening & app security.

· Unified Management: APIs give full-stack visibility & monitoring.

What is Cloud Application Security?

Application security = measures to protect data/code within apps, covering design, development, and post-deployment.

· Focus: securing SaaS, PaaS, IaaS application layer.

· Prevents vulnerabilities: XSS, SQL injection, CSRF, poor authentication/session handling.

· Part of zero-trust security to protect frequent cloud app access.

Why Cloud Application Security is Needed?

· Identifies apps in use & employee access levels.

· Protects distributed organizational data across cloud apps.

· Ensures security compliance by mitigating cloud threats.

Cloud Application Security Threats & Solutions

Security Challenges of Cloud Applications

1. Limited Visibility: Logging/monitoring reduced in PaaS; less transparency for users.

2. Increased Application Scope: Management plane security is critical; multi-access risks sensitive data exposure.

3. Changing Threat Models: Must adapt to provider’s shared security model & response processes.

4. Reduced Transparency: External integrations hide app processes, reducing visibility.

Contact Me: 📧 Email: adii.utsav@gmail.com 🔗 LinkedIn: https://www.linkedin.com/in/aditya-kumar-3241b6286/ 💻 GitHub: https://github.com/Rememberful