And welcome back now in today's video, we'll be discussing about the S3 encryption.
Now, before we go ahead and discuss more about it, let's take a simple use case to understand the
need.
Now, we understand this with a simple example of an external hard disk drive.
So many of you might be using some kind of a portable external hard disk drive, something similar to
the one that is being shown.
So generally what happens is that since it is portable, a lot of people, they carry it while they're
traveling across multiple places.
In fact, one of my friends also used to have this external drive and during travel, he lost it.
And this driver had a lot of sensitive information.
So actually he had to change his credit card, debit card, pins, his username, password, etc, across
a lot of websites.
So this is a risk because if the data is stored in plain text within your hard drive and if your attacker
manages to fake it, then a lot of unwanted things can happen.
So it is very important to be proactive.
And this is the reason why a lot of vendors like Western Digital, they come up with features associated
with the hardware based encryption.
So what really happens is that you can go ahead and encrypt your data within your external hard disk
drive with the features of hardware based encryption.
So even if your portable hard disk drive is lost, an attacker tries to connect to his laptop.
He'll not be able to fit any information because everything within this, this is encrypted now, similar
to the use case that we were discussing of a potential high distrait, even S3, primarily because since
it is a storage service and a lot of organization, they makes use of S3 to store very sensitive data,
including the database backups and others.
It is important for encryption feature to be there, no database as three or four multiple approaches
to encrypted data which has been stored in history.
Now there are two major approaches that you need to understand.
The first is the server side encryption and the second one is that blindsight encryption.
So servers encryption is where a customer can request Amazon S3 to encrypt your object before saving
it on disk in its data center and decrypt it when you go ahead and download your objects.
So when you upload your object to a street which is having a server side encryption before that data
is stored in the disk behind the scenes as things will go in an encrypted data.
And before you go ahead and download the data, S3 will go ahead and decrypt that data.
So that is more of a transparent way.
So that is part of this overside encryption.
You also have blindsight encryption.
They go ahead and encrypt the data from the client side and then you upload it to the S3.
Now discussing about the server side encryption within server side encryption, there are three primary
options that you can use depending upon the use case.
The first one is server side encryption with Amazon s three managed keys.
So this is therefore is the SS East Haven S-T.
You also have server side encryption with customer Mannerist keys stored in games also as well as the
SS even Kamus.
Third one is the server side encryption, but customer provided keys also referred as the SS e Haven
S..
So let's quickly explore what each one of these options brewing now coming to the fourth option of SASE
that Amazon is tremendous.
E what happens is that in this approach, each object is encrypted with a unique key.
So if you upload then objects within S3, all of that in objects will be encrypted with a unique thing.
Now this approach of is is East Haven S3.
It makes use of us those two blocks over to encrypted data, which is easy as Hovan 256.
So the approach can be simplified with a diagram where you have a domain and this data is encrypted
with one key.
Now you also have a data to and this data is also encrypted with a different key.
So the key is to encrypt different objects unique in this approach.
No second option, you're under the server side encryption is to assess it with seeing it also.
Therefore, as the SASE Haven is now in this approach of encryption of data happens with the CMG give,
it is stored in the key management service so you can go ahead and choose your own custom system as
well.
So encrypting the data with only CNMC allows us.
AIM was to create a rotate, disabled the cookies.
You can also have granular access control on the same kit and you can also enable auditing where so
the overall concept remains to be seen.
So you can create your own campaign.
CMS and that same gate can be used to go ahead and encrypt and be clearly.
That third option, and that is oversight encryption is the SS eat with the customer provided it also
referred as the SS agency.
So what happens in this approach is that the encryption key needs to be provided as part of the request
and S3 will manage both the encryption and decryption options for you.
So let's take an example where you have a plain text data and you want to encrypt it in a street before
it is too.
So along with the plain text data, you also provide the key.
So this key is being provided by the customer.
So as three, it receives the data, it receives the key and with this key items as they will go ahead
and encrypt data for you in a similar way, whenever you want to decrypt this specific data, you would
again have to send a decrypt operation with the same key.
This is basically the same strategy.
So you'd have to provide the same key to both encrypt and decrypt the data.
So that is what Etsy means.
So enough of the theoretical aspect.
Let's jump into the practical so that this becomes really interesting.
So currently I'm in the S3 console.
Let's go ahead and create a stream of data for you.
So I say sample bucket for encryption and we'll go ahead and we create the S3 bucket.
Great, let's go inside this bucket and let's click on upload, we add a file and I have added a file
coalesce one dot GBG will go ahead and will do a number of.
So by default, this object which is uploaded, it is not encrypted, so if you look into these storage
plus the storage glasses standard and the other encryption, the encryption is not.
So this is basically the plain text data which is stored in the S3 right now.
If you go to the properties here, there is an option of default encryption.
Now, by default, it is none.
However, you can use the E 256 as well as the item schemas.
So this is 256, if you will see it is as s e hyphen S3.
So this is the first one that we were discussing.
And you also have the inverse CMS where you can go ahead and select the key Miski through which you
want to perform the encryption and the decryption operation.
So let's take one example of the S.
S e hyphen S3.
So we use the E 256 and we'll click on or late.
So once you have enabled this, let's go back to the Audu.
Let's upload one more object.
And this time the name is the one that GBG let's go ahead and do an upload.
So let's look into the properties all year.
And this time under the encryption, you will see it is, yes, 256.
Now, one important part to remember is that if you enable the encryption at a later space industry,
bucking the existing objects which were uploaded previously when the encryption was done, they continue
to stay in the plaintext.
So if you'll open up one, not GBG, you'll see the encryption is not great.
So I hope at a high level of you you understood what this means.
Now, we also take one more example of S.
S e hyphen.
See, as you were discussing with this approach, along with the data, you'll also have to specify
the key.
So the first thing that we need to do is we'll have to generate the key audio.
So I'm in Masiello and the first thing that we do is we go ahead and then the data is 120 bakkie.
Right.
So the output is basically the key that we intend to use.
So this is the key that we can supply with the S.
S even agency operation.
So the next step is to go ahead and upload some data in of necessity.
So currently I'm in Michel and you have these C.P.E. operation, which is basically to copy the local
file to estimate now within a year, if you see that there are certain operations related to the SASE
agency.
So these are the ones which are highlighted here.
So you have the SNC.
I see where you can specify each 256.
You will also have to provide the SSI hyphen agency hyphen key.
So you'll have to provide the key while uploading the object.
So let's pridham so within the CLIA Les Gordon creative class been modot and this is the file that will
be uploaded.
So let's go ahead and do a double asterisk be specified.
The bucket with a sample bucket for encryption and along with that will also specify that they may not
be defined.
So in the first step we have basically uploaded the text file without any encryption OIA and the upload
was successful.
So now let's go ahead and try to do it with the encryption option.
Before we do that, let's go ahead and rename the file to assess Etsy and let's run the same code.
However, this time we also have to specify certain operations.
So the first thing let's go ahead and change the filing.
So this is the CIA C and you'll have to specify the options which were specified in the S.L.
So the first one was you'd have to specify as SBA fancy Aurier.
Let's go this up.
And along with that, you also have to specify the SaSe Haven C hyphen T.
And you can specify the key, which Gajendra?
So this time, when you go ahead and applaud, you see the upload has been successful, so this is what
is referred to as the server side encryption with customer provided.
No, if you'll quickly refresh where you are, you should see that there are two phase demo that takes
the NSA CIA facility so that they may not be fixed is basically associated with the server side encryption
of E 256 since we have enabled it within the book.
And you also have access even if you open it up.
If we look into the outside encryption, it is esses EPA fancy grade.
So at a high level or you I hope you understood what the server side encryption in S3 is along with
the three options you not.
The next available option is the claim site encryption.
So in the earliest that we were discussing that you have our oversight and clients within.
So say there are three options and within Clydeside, basically what you can do is you can go ahead
and encrypt the data, add blindsight and then send the encrypted data to history.
So before the data goes to history, that data is already in encrypted manner.
Now this is a little different from the SS e hyphen S. Because within the SS agency we provide the plain
text, the data, and then we provide the encryption key.
So Eatables S3 has the logic to take the plaintext data, to take the encryption key and perform the
encryption operation.
So that logic is already present within these three, together with clients and encryption, you do
not use technology.
All that logic is stored in the compromise or at your application site and you directly go in and send
encrypted data to history.
Great.
So that's the high level overview about S3 encryption.
I hope this video has been informative for you and I look forward to seeing the next video.