Advanced 18 min read

Encryption Basics on AWS

By the end of this lesson, you'll be able to:

Distinguish encryption in transit from encryption at rest
Explain why encryption is one security layer and does not by itself decide who is authorized to access data
Identify which of the two encryption concepts applies to a described scenario

Prerequisites: "AWS CloudTrail: Auditing Account Activity"

Two different moments, two different protections

Encryption in transit protects data while it's moving between systems — commonly using HTTPS/TLS between a client and a service, or between services communicating with each other. Encryption at rest protects data while it's stored — sitting in a database, an S3 bucket, or an EBS volume, not actively being transmitted anywhere.

Diagram showing a client connecting to an application over an encrypted-in-transit HTTPS connection, and the application storing data in a database or storage service that is encrypted at rest. — Two separate protections — data in motion, and data while stored — and neither one alone decides who is authorized to access it.

Encryption is one layer, not the whole answer

This is worth stating directly: encryption does not remove the need for access control. Encrypting a database doesn't matter much if an over-permissioned IAM identity can still read it in decrypted form through a normal, authorized query — encryption protects the data from being read by someone who intercepts the raw bytes (in transit) or gains access to the raw storage medium (at rest), not from someone who's already been granted legitimate access to query it. Least privilege (Module 2) and encryption solve genuinely different problems, and a secure design needs both, not one instead of the other.

This lesson deliberately stays at the concept level

This lesson doesn't go deep into cryptographic algorithms or key management mechanics — the next lesson, on AWS KMS, picks up exactly where the "how are the actual keys managed" question begins. For now, the beginner-level takeaway is simply recognizing which of the two concepts — in transit, or at rest — applies to a given scenario, and remembering that encryption is a layer alongside access control, not a substitute for it.

Exercise

For each of the following, decide whether it's primarily about encryption in transit or encryption at rest: (1) a mobile app connecting to an API over HTTPS, (2) a database's stored data being unreadable to someone who gains direct access to its underlying disk. Then explain why an application with both types of encryption enabled could still have a serious security problem if its IAM permissions are overly broad.

Show hint

One scenario is about data moving; the other is about data sitting still. The IAM question is about what encryption does and doesn't protect against.

Encryption Basics on AWS Quiz

1. What does encryption at rest protect, specifically?

Data while it is stored, such as in a database or object storage Data only while it is moving between a client and a server Which IAM identities are authorized to access the data Nothing — encryption at rest is a marketing term with no real effect

2. Encryption removes the need for access control.

True False

My Notes

Questions about this lesson

No questions yet — be the first to ask.

Summary

Encryption in transit protects data while it moves between systems, and encryption at rest protects data while it is stored — two distinct, complementary protections that, together, still don't decide who is authorized to access the data in the first place; that remains a separate concern handled by IAM and other access controls.

❬ Previous Next ❭