Data Protection and Encryption

The previous topic governed configuration: who may act, and whether the account still matches your requirements. This one protects the thing all of that exists for. Task 4.2 of the SOA-C03 exam guide asks you to implement strategies that protect data, and it names the 4 pieces in order: classify it, encrypt it where it sits, encrypt it while it moves, and keep the credentials that open it out of your code.

What This Topic Covers

• Building a data classification scheme with tiers that carry real handling rules, and why over-classification is a failure rather than a safe default
• Tags as the handle that connects a classification tier to a bucket policy, a KMS key policy, and an AWS Config rule
• Amazon Macie: the S3 bucket inventory, policy findings, automated sensitive data discovery against sensitive data discovery jobs, managed and custom data identifiers, allow lists, and the Regional rules for a delegated administrator
• Envelope encryption and data keys, and why AWS KMS protects keys rather than data
• Customer managed, AWS managed, and AWS owned KMS keys, and the requirements that force each one
• Key policies, grants, and encryption context, including why a KMS key policy grants nothing implicitly
• Key rotation and what it deliberately leaves alone, key states, and the deletion waiting period
• Encryption behavior in Amazon S3 and Amazon EBS, including S3 Bucket Keys and the resources you cannot encrypt in place
• ACM certificates: validation methods, managed renewal eligibility, Regional placement, and ELB security policies
• Enforcing HTTPS across load balancers, CloudFront, and S3
• Choosing between Secrets Manager, Parameter Store, and AppConfig, and rotating secrets safely with staging labels

Why It Matters

Encryption questions on the exam are rarely about algorithms. They hand you a failure, an AccessDenied on a cross-account snapshot restore, a certificate that expired despite living in ACM, a rotation that ran and broke an application, and ask which boundary was crossed. Answering means knowing where each service stops: KMS protects keys and never sees your data, ACM maintains only what it issued and what you use, and Secrets Manager moves a label last so a failed rotation is not an outage.

The job pressure is the same shape. Every control here has a cost, which is why classification comes first: it decides which data gets the expensive treatment. Get that order wrong and you either pay to protect log files or discover, during an audit, that customer records were sitting in the cheap tier all along.