Data Protection
Encryption at rest with KMS
A KMS customer managed key has a key policy (the root of all authorization for that key), optional grants, and IAM policies that only take effect if the key policy delegates to IAM. Envelope encryption means a data key encrypts the object and the CMK encrypts the data key. Automatic rotation is yearly, keeps the same key ID and ARN, and applies only to symmetric CMKs with AWS-generated material - imported key material and asymmetric or HMAC keys do not auto-rotate. Multi-Region keys replicate key material so ciphertext is decryptable in another Region.
For S3 the options are SSE-S3 (AES-256, AWS-managed), SSE-KMS (CloudTrail audit trail and per-key authorization, with bucket keys cutting KMS request cost by roughly 99%), DSSE-KMS (double layer for regulated workloads), SSE-C (you supply and manage the key; AWS does not store it), and client-side encryption. Default encryption applies to new objects only; existing objects keep their prior state.
Controlling access to data
Block Public Access has four settings and belongs on at the account level. Enforce TLS with a bucket policy denying when aws:SecureTransport is false, and enforce upload encryption by denying s3:PutObject unless s3:x-amz-server-side-encryption matches. Presigned URLs inherit the signer's permissions and expire. Object Lock requires versioning and gives WORM in governance or compliance mode. Macie discovers sensitive data in S3 only - it does not scan EBS and it does not remediate.
Secrets Manager stores and rotates credentials via Lambda and supports cross-account access; SSM Parameter Store SecureString is cheaper and KMS-integrated but has no native rotation.
Traps
SSE-KMS readers need kms:Decrypt and the key policy must allow them - encryption that succeeds but breaks readers is a favorite scenario. Enabling default encryption does not retroactively encrypt. Deleting a CMK is irreversible after the waiting period.
Worked example: a bucket must reject unencrypted or non-TLS uploads. Two statements - deny s3:* when aws:SecureTransport is false, and deny s3:PutObject when s3:x-amz-server-side-encryption is not aws:kms.