Taking the first step
|
Purpose |
Help determine which AWS cryptography services are the best fit for your organization. |
|
Last updated |
January 31, 2025 |
|
Covered services |
|
|
Related guides |
Introduction
Cryptography is a cornerstone of security in cloud computing, helping to ensure data confidentiality, integrity, and authenticity. In a cloud environment, sensitive data may traverse public networks and reside on shared infrastructure, making robust cryptographic measures essential for protecting against unauthorized access or tampering.
AWS offers a comprehensive range of cryptographic services to secure data, manage encryption keys, and protect sensitive information. These include AWS Key Management Service (KMS) for centralized key management, AWS CloudHSM for PKCS11 applications and dedicated hardware security modules, and the AWS Encryption SDK for client-side encryption. AWS Secrets Manager is a service that enables you to securely store, manage, and retrieve sensitive information such as database credentials, API keys, and other secrets throughout their lifecycle. AWS Certificate Manager (ACM) simplifies the process of provisioning, managing, and deploying publicly trusted transport layer security (TLS) certificates for use with AWS services. The AWS Private Certificate Authority (PCA) enables you to generate and distribute x509 certificates for your internal resources.
The guide is designed to help you choose the AWS cryptography services and tools that are the best fit for your needs and your organization.
A two-minute segment of a presentation introducing best practices for cryptography.
Understand
Choosing the right AWS cryptography services depends on your specific use case, data security requirements, compliance obligations, and operational preferences as outlined in the following tables.
If you need to securely manage encryption keys, consider AWS Key Management Service (KMS). It allows you to create, rotate, and manage cryptographic keys integrated with other AWS services. KMS uses FIPS-validated HSMs to help you meet compliance rewuirements and to provide assurance on the correctness of the implementation of the cryptographic primitives exposed by KMS. Some applications require certain cryptographic functions or application interfaces that are only available with a traditional HSM and AWS CloudHSM provides dedicated hardware security modules (HSMs) in the cloud which gives you full control over your cryptographic keys and operations.
When choosing between AWS cryptography services, consider the following requirements.
| Requirement | Service |
|---|---|
| Low effort, fully managed | AWS KMS or AWS Secrets Manager |
| Require specific application interfaces or cryptographic algorithms not supported by KMS | AWS CloudHSM |
| Encrypting/decrypting data in your applications | AWS Encryption SDK |
| Simplified public TLS Certificate Management | AWS Certificate Manager |
| Secrets management | AWS Secrets Manager |
By aligning your requirements with these options, you can implement cryptographic solutions tailored to your security and operational needs.
Consider
Choosing the right AWS cryptography service involves understanding your specific security, operational, and compliance needs. AWS offers a variety of cryptographic services, each designed to address different use cases, from key management to data encryption and secure communication. To make an informed decision, you should evaluate your requirements based on several critical criteria, including your use case, control and flexibility needs, compliance obligations, cost considerations, and integration with AWS services. These criteria will help you align your choice with your organization’s security goals and operational workflows.
Consider what you need the cryptographic service for: data encryption, key management, secure communication, or secrets management. For example, AWS KMS is ideal for encryption integrated into AWS services, while AWS CloudHSM suits organizations who need certain cryptographic capabilities, application interfaces, or a single-tenant HSM, often due to stringent compliance or specific application needs. Clarifying the purpose ensures you select a service suitable for for your requirements, optimizing both functionality and cost.
Choose
Choosing the right AWS cryptography service involves understanding your specific security, operational, and compliance needs. AWS offers a variety of cryptographic services, each designed to address different use cases, from key management to data encryption and secure communication. To make an informed decision, you should evaluate your requirements based on several critical criteria, including your use case, control and flexibility needs, compliance obligations, cost considerations, and integration with AWS services. These criteria will help you align your choice with your organization’s security goals and operational workflows.
| Target use case | When would you use it? | Recommended service |
|---|---|---|
| Key management | To securely create, rotate, and manage cryptographic keys integrated with other AWS services | AWS KMS |
| Key management | For specific application integrations or cryptographic primitives | AWS CloudHSM |
| Data encryption | To implement client-side encryption to protect sensitive data such as customer details or intellectual property. | |
| Secure communications | To protect data in transit and simplify the management of SSL/TLS certificates. | |
| Secrets and credential management | To securely store and retrieve application secrets like database credentials, API keys, or certificates. |
Use
You should now have a clear understanding of what each AWS cryptography service does, and which ones might be right for you.
To explore how to use and learn more about each of the available AWS cryptography services, we have provided a pathway to explore how each of them works. The following sections provide links to in-depth documentation, hands-on tutorials, and other resources to get you started.
-
Get started with AWS Certificate Manager
Start using AWS Certificate Manager, including working with both public and private certificates.
-
Best practices for AWS Certificate Manager
Review recommendations that can help you use AWS Certificate Manager more effectively.
-
AWS Certificate Manager FAQ
Review the AWS Certificate Manager (ACM) FAQ page for detailed answers to common questions about ACM's features, capabilities, and usage. It covers topics such as the types of certificates ACM manages, integration with other AWS services, and guidance on provisioning and managing SSL/TLS certificates.
Explore
-
Research and resources
Explore AWS blogs, videos and tools on cryptography.
-
Videos
Watch these videos from the AWS Developers channel on YouTube to further develop and refine your cryptography strategy.
