Many Amazon Web Services (AWS) customer workflows require ingesting sensitive and regulated data such as Payments Card Industry (PCI) data, personally identifiable information (PII), and protected health information (PHI). In this post, I’ll show you a method designed to protect sensitive data for its entire lifecycle in AWS. By Raj Jain.
An existing method for sensitive data protection in AWS is to use the field-level encryption feature offered by Amazon CloudFront. This CloudFront feature protects sensitive data fields in requests at the AWS network edge. The chosen fields are protected upon ingestion and remain protected throughout the entire application stack. The notion of protecting sensitive data early in its lifecycle in AWS is a highly desirable security architecture. However, CloudFront can protect a maximum of 10 fields and only within HTTP(S) POST requests that carry HTML form encoded payloads.
A complex part of any encryption solution is key management. To address that, author uses AWS Key Management Service (AWS KMS). AWS KMS simplifies the solution and offers improved security posture and operational benefits. Article sections go over it in detail:
- Solution overview
- Field-level encryption process
- RSA key generation and inclusion in Lambda@Edge
- HTTP API request handling by CloudFront
- Lambda@Edge processing
- Lambda@Edge response
- Forward the request to the origin server
- Field-level decryption process
Source: https://aws.amazon.com/blogs/security/how-to-protect-sensitive-data-for-its-entire-lifecycle-in-aws/
in individual storage silos using volume encryption, object encryption or database table encryption. However, if you have sensitive workloads, you might need additional protection that can follow the data as it moves through the application stack. Fine-grained data protection techniques such as field-level encryption allow for the protection of sensitive data fields in larger application payloads while leaving non-sensitive fields in plaintext. Excellent read!
[Read More]