- Newest
- Most votes
- Most comments
Hello rePost-User-0099370, thank you for reaching out. Hopefully the below information provides you with the answer you're looking for. If the information provided does not satisfactorily answer your question, I recommend opening a support case with AWS Support as they can provide more granular and customized support for you.
Default Algorithm: AWS Step Functions uses Advanced Encryption Standard (AES) with 256-bit encryption (AES-256) as the default algorithm for encrypting data at rest when no customer-managed KMS key is set. This encryption is provided automatically and transparently by AWS, ensuring a baseline level of security for all data stored within Step Functions.
Here are some key points about the default encryption in AWS Step Functions:
Transparent server-side encryption: AWS Step Functions automatically encrypts all data at rest without any additional action required from the user.
AWS-owned keys: By default, AWS Step Functions uses AWS-owned keys for encryption. These keys are managed entirely by AWS and are used across multiple AWS accounts.
No additional cost: The default encryption using AWS-owned keys is provided at no extra charge to the customer.
Automatic key management: AWS handles all aspects of key management for the default encryption, including key rotation and security.
Compliance: This default encryption helps meet many regulatory and compliance requirements for data protection.
While the default encryption provides a strong baseline for security, customers with more stringent security requirements or those in highly regulated industries may want to consider using customer-managed keys through AWS Key Management Service (KMS). This option provides additional control over the encryption keys, including the ability to audit key usage, rotate keys on a custom schedule, and revoke access to the keys if needed.
Additional Resources:
Data at rest encryption in Step Functions - AWS Step Functions
EncryptionConfiguration - AWS Step Functions
Hopefully this helps answer your question.
Best wishes and thank you for using AWS!
Brian
answered 2 years ago
Relevant content
asked 4 years ago
asked 2 years ago
- AWS OFFICIALUpdated 9 months ago
If you read through the documentation - it is mentioned that AWS Step Function uses AWS owned KMS key to encrypt data at rest by default. The default algorithm used for symmetric AWS KMS encryption is AES-GSM 256
@Aritro Sen AWS KMS doesn't encrypt the data. It generates a data encryption key (DEK) to be used by the service for encrypting its data. That key is just a 256-bit random number and doesn't specify which implementation of AES-256 the service uses it with. I'm reasonably sure Step Functions and the underlying services on which it's built use 256-bit AES-GCM (Galois/Counter Mode, not GSM), as you mentioned, but I also agree it's a bit funny documentation doesn't appear to mention it.
@Aritro Sen, sorry, but the DEK with which Step Functions encrypts data is not derived from or in any other way cryptographically related to the KMS key. A DEK is absolutely nothing but a random number. The KMS key is technically the HBK you mentioned, but the keys that are cryptographically derived from it are only used to encrypt the DEKs, not to derive them. Keys derived from the HBK are used to encrypt the DEKs to protect the HBK from cryptanalytic attacks that would otherwise be conceivable when the plaintext and ciphertext versions of individual DEKs are exposed.
@Leo K sorry it was a typo from my end. It's AES GCM 256 bit. I commented on a high level that Step Function uses AWS owned key for encryption. Of course under the hood encryption actually happens with HBK(HSM backing key) which is further wrapped with Domain Key which is further wrapped under Region Key. AWS KMS keys follows a hierarchy and it's maintained by HSM fleets fully managed by AWS KMS. The HBK actually generates the DEK with its uniquely generated token which is designed to never leave the HSM in plaintext.
@Leo K During encryption the DEK is generated which is the combination of the active HBK and a random number. Only the number gets embedded into the ciphertext which is returned to the client. DEK is never exposed out of the HSM. During Decryption the number gets extracted from ciphertext and the DEK gets re-generated again which is then used to decrypt the ciphertext into plaintext.