Data at rest, integrity, retention and backup

Encrypting data at rest in Amazon S3

Skill 5.2.1 asks you to pick the right encryption at rest. S3 is where most of those questions live. Since January 2023 every new object is encrypted with SSE-S3 automatically, so the real question is never “is it encrypted?” but who holds the key, who can audit its use, and who can turn it off.

Server-side or client-side? KMS or CloudHSM?

Server-side means AWS encrypts after receiving your data, so it is easy and works with every AWS feature. Client-side means you encrypt before sending (AWS Encryption SDK, Amazon S3 Encryption Client, DynamoDB Encryption Client), so AWS stores only ciphertext. Choose client-side only when a rule says AWS or the storage admins must never see plaintext. For the key itself, KMS is the default answer; choose CloudHSM (or a CloudHSM key store) only when the question demands a single-tenant HSM you control.

$ aws s3api put-bucket-encryption --bucket fin-reports \
  --server-side-encryption-configuration '{"Rules":[{
    "ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms",
      "KMSMasterKeyID":"arn:aws:kms:us-east-1:111122223333:key/1234abcd-..."},
    "BucketKeyEnabled":true}]}'

# bucket policy statement
{ "Effect":"Deny", "Principal":"*", "Action":"s3:PutObject",
  "Resource":"arn:aws:s3:::fin-reports/*",
  "Condition":{"StringNotEqualsIfExists":{
    "s3:x-amz-server-side-encryption-aws-kms-key-id":
      "arn:aws:kms:us-east-1:111122223333:key/1234abcd-..."}}}

EBS, RDS, DynamoDB and EFS at rest

Each storage service has one quirk the exam loves: when can you turn encryption on, and what happens to snapshots, replicas and shares. Learn the four rules below and most “the team forgot to encrypt” questions answer themselves.

DynamoDB and EFS in one paragraph each

DynamoDB encrypts every table at rest, always; you can’t turn it off. You only choose the key: AWS owned (default, free, no audit), AWS managed (aws/dynamodb) or customer managed. You can switch between them at any time on an existing table.

Amazon EFS encryption at rest is chosen when you create the file system and can’t be added later. To encrypt an existing one, create a new encrypted file system and copy the data. Encryption in transit is separate: mount with the EFS mount helper option -o tls, and enforce it with a file system policy that denies when aws:SecureTransport is false.

$ aws rds create-db-snapshot --db-instance-identifier legacy-db \
    --db-snapshot-identifier legacy-plain
$ aws rds copy-db-snapshot --source-db-snapshot-identifier legacy-plain \
    --target-db-snapshot-identifier legacy-enc \
    --kms-key-id alias/rds-prod
$ aws rds restore-db-instance-from-db-snapshot \
    --db-instance-identifier legacy-db-enc \
    --db-snapshot-identifier legacy-enc

Object Lock and Glacier Vault Lock

Encryption stops people reading data. Skill 5.2.2 is about stopping people changing or deleting it: write once, read many (WORM). In S3 that is Object Lock; in the original S3 Glacier vault API it is Vault Lock. Both are favourite answers when the question says “regulator”, “immutable” or “even the root user”.

$ aws s3api put-object-lock-configuration --bucket trade-records \
  --object-lock-configuration '{"ObjectLockEnabled":"Enabled",
    "Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Years":7}}}'

$ aws s3api delete-object --bucket trade-records --key 2026/q3.csv \
    --version-id 3HL4kqtJlcpXroDT
An error occurred (AccessDenied) when calling the DeleteObject operation

Integrity: versions, MFA Delete, checksums, signing

The rest of skill 5.2.2 is about proving data wasn’t changed: keeping old versions, making deletes harder, checking files byte for byte, and signing code so only trusted builds run. These are quick wins when the question says “detect tampering” or “verify”.

$ aws cloudtrail validate-logs --trail-arn arn:aws:cloudtrail:us-east-1:111122223333:trail/org \
    --start-time 2026-10-01T00:00:00Z
Results found for 2026-10-01T00:00:00Z to 2026-10-10T08:00:00Z:
  216/216 digest files valid
  4312/4312 log files valid

$ aws lambda create-code-signing-config \
  --allowed-publishers SigningProfileVersionArns=arn:aws:signer:...:/signing-profiles/release/abc \
  --code-signing-policies UntrustedArtifactOnDeployment=Enforce

Lifecycle and retention policies

Skill 5.2.3: keep data exactly as long as rules require, and no longer. Too short breaks compliance; too long costs money and widens the blast radius of a breach. The tools are S3 Lifecycle, Object Lock retention, EFS Lifecycle management and backup retention on services such as FSx for Lustre.

EFS and FSx for Lustre

EFS Lifecycle management moves files that haven’t been accessed for a set number of days to the Infrequent Access or Archive storage classes, and can move them back to Standard on first access. It is about cost, not deletion; EFS has no built-in expiry, so retention and deletion of backups go through AWS Backup.

FSx for Lustre persistent file systems take automatic daily backups with a retention period you choose (up to 90 days) and support user-initiated backups that you keep until you delete them. For longer or centrally governed retention, manage them with AWS Backup plans.

{ "Rules": [{
    "ID": "logs-7y", "Status": "Enabled", "Filter": {"Prefix": "logs/"},
    "Transitions": [{"Days": 30, "StorageClass": "STANDARD_IA"},
                    {"Days": 365, "StorageClass": "DEEP_ARCHIVE"}],
    "Expiration": {"Days": 2555},
    "NoncurrentVersionExpiration": {"NoncurrentDays": 30},
    "AbortIncompleteMultipartUpload": {"DaysAfterInitiation": 7}
}]}

AWS Backup, Vault Lock and ransomware

Skill 5.2.4 asks you to design backups that survive the worst day: an attacker with admin rights who encrypts or deletes everything. AWS Backup centralises backups for EBS, EC2, RDS, Aurora, DynamoDB, EFS, FSx, S3 and more; Vault Lock and logically air-gapped vaults make those backups untouchable.

Logically air-gapped vaults

A logically air-gapped vault is always locked in compliance mode (minimum retention 7 days) and is encrypted with an AWS owned key by default, or a customer managed key from a separate recovery account. You share it with chosen accounts through AWS RAM so a clean account can restore directly, and with multi-party approval you can recover even if the vault-owning account is lost. Unencrypted Aurora, DocumentDB and Neptune clusters can’t be stored there.

$ aws backup put-backup-vault-lock-configuration \
    --backup-vault-name prod-vault \
    --changeable-for-days 3 \
    --min-retention-days 7 --max-retention-days 35

$ aws backup describe-backup-vault --backup-vault-name prod-vault \
    --query '{Locked:Locked,LockDate:LockDate}'
{ "Locked": true, "LockDate": "2026-10-13T09:00:00Z" }

Replication, DLM and DataSync

Backups protect against deletion; replication keeps a live second copy somewhere else. The exam pairs three tools with skill 5.2.4: S3 Replication (and its KMS traps), Amazon Data Lifecycle Manager for EBS snapshots and AMIs, and AWS DataSync for moving files with built-in integrity checks.

Amazon Data Lifecycle Manager (DLM)

DLM automates creating, keeping and deleting EBS snapshots and EBS-backed AMIs. Policies target volumes or instances by tag, run on a schedule, keep a count or age, and can copy snapshots to other Regions (with a destination KMS key) or share them with other accounts. It is the low-effort answer when only EBS is in scope; when the question spans several services or needs Vault Lock, pick AWS Backup. For extra protection, EBS snapshots can also be locked, and Recycle Bin retention rules let you recover snapshots and AMIs that were deleted by mistake.

AWS DataSync

DataSync moves data between on-premises storage (NFS, SMB, HDFS, object storage), other clouds and AWS (S3, EFS, FSx), and between AWS storage services. Data is encrypted in transit with TLS, and DataSync verifies integrity with checksums during the transfer and, optionally, compares source and destination at the end. It’s also the usual tool to copy data into a new encrypted EFS file system.

$ aws dlm create-lifecycle-policy --description "daily-ebs" \
  --state ENABLED --execution-role-arn arn:aws:iam::111122223333:role/AWSDataLifecycleManagerDefaultRole \
  --policy-details '{"ResourceTypes":["VOLUME"],
    "TargetTags":[{"Key":"Backup","Value":"daily"}],
    "Schedules":[{"Name":"daily","CreateRule":{"Interval":24,"IntervalUnit":"HOURS"},
      "RetainRule":{"Count":14},
      "CrossRegionCopyRules":[{"TargetRegion":"us-west-2","Encrypted":true,
        "CmkArn":"arn:aws:kms:us-west-2:111122223333:key/abcd-...",
        "RetainRule":{"Interval":30,"IntervalUnit":"DAYS"}}]}]}'

Cheatsheet extras: S3 policy conflicts, ACLs and encryption in other services

The cheat sheet calls S3 policy conflicts an “exam essential topic”: what happens when an IAM policy, a bucket policy and an ACL disagree? It also lists encryption at rest for services this lecture didn’t cover (Lambda, Kinesis, SQS, Storage Gateway, Snow Family), and replication rules that have changed since it was written.

Encryption at rest in services not covered above

{
  "Sid": "OnlyHRCanRead",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::perf-reviews/*",
  "Condition": { "ArnNotEquals": {
    "aws:PrincipalArn": "arn:aws:iam::111122223333:role/HRReviewers" } }
}

Lecture summary map

Day 3 on one screen.

1. Mind map

2. Match the requirement to the control

3. “If the question says… pick…”

Must-remember cheat sheet

Core quiz

Check the basics first. Pick an answer, then press Check.

Hard quiz

Harder than most real exam questions on purpose, with one “choose two” and one matching question. Aim for 9 out of 12 before Day 4.

Practice test questions (from your mock exams)

These 10 questions match today’s topics. 8 come from your own mock exams (the “practice tests” folder); the wording was tidied, and where a mock answer was out of date or wrong, the explanation says so, with the mock and question number at the end. The last 2 are new exam-style questions (marked “New question”) written in October 2026 from the SCS-C03 exam guide and current AWS documentation, to cover recent changes.

Hands-on lab (30 minutes, low cost)

1. Create a bucket with default SSE-KMS (a customer managed key) and a Bucket Key. Upload a file, then check head-object for ServerSideEncryption and BucketKeyEnabled.
2. Create a second bucket with Object Lock, set default retention to 1 day in governance mode (never compliance in a personal account). Try to delete a version, then delete it with --bypass-governance-retention.
3. Put a legal hold on another version and see that bypass doesn’t help until you remove the hold.
4. Run aws ec2 get-ebs-encryption-by-default in two Regions and turn it on where it is off.
5. In AWS Backup, create a vault, back up a small DynamoDB table on demand, and add a governance-mode Vault Lock with min retention 1 day. Remove the lock afterwards.
6. If your trail has log file validation, run aws cloudtrail validate-logs for the last day.
7. Clean up: delete test objects after retention ends, the backup, the vault and the buckets.