Chapter 4 · Security and Compliance·v2.0.0·Updated 6/3/2026·~8 min

What's changed: Deepened SOA-C02 Chapter 4 to Associate depth (tables, scenarios, FAQ, traps; localized figures)

4.2Data Protection and Encryption (KMS, ACM)

Key points

Understand encryption at rest (KMS for S3/EBS/RDS), encryption in transit (TLS with ACM certificates), and secrets management operations.

Protect data both at rest and in transit. On AWS, KMS protects at rest and TLS (certificates via ACM) protects in transit.

4.2.1Encryption at rest and in transit

Diagram showing at rest (KMS: S3 SSE/EBS/RDS encryption, key management & audit, secrets via Secrets Manager/SSM) and in transit (TLS: HTTPS, ACM certificates on ELB/CloudFront, ACM auto-renews certs). — At rest (KMS) and in transit (TLS/ACM)

KMS: manages keys for encryption at rest of S3 (SSE), EBS, RDS, etc., with auditable usage.
ACM: issues and auto-renews TLS certificates, applied to ELB/CloudFront to protect data in transit.
Secrets Manager / SSM Parameter Store: store passwords/API keys encrypted.

Exam point

Common on SOA: encryption-at-rest keys = KMS, issue/auto-renew TLS certs = ACM, avoid cert expiry = ACM auto-renewal. Enable EBS/RDS encryption at creation time as a rule.

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started free Log in