AWS Data Security
Encryption & Key Management Without the KMS Sprawl.
What this hub covers
Most "AWS data breaches" are S3 misconfigurations, leaked secrets, or unencrypted analytics joins. The guides below cover bucket-level controls and Block Public Access patterns, secret rotation with Secrets Manager, AWS KMS post-quantum cryptography (ML-KEM hybrid TLS now in KMS, ACM, and Secrets Manager since April 2026; ML-DSA digital signatures GA in KMS), Amazon Macie for PII discovery and data security posture management in S3, and privacy-preserving analytics with Clean Rooms.
6 guides in this hub
Each one is written for a production AWS estate: the configuration, the trade-offs and what the auditor asks for. Part of the AWS Security & Compliance hub.
AWS S3 Security Best Practices: Preventing Data Exposure
S3 misconfigurations are still the leading cause of headline data breaches. Bucket policies, encryption, access logging, Block Public Access, and the practices that keep "developer left the bucket public" from being your incident.
Read the guideAWS Secrets Manager vs Parameter Store: When to Use Which
Secrets Manager rotates and costs $0.40 per secret per month. Parameter Store doesn't rotate and is mostly free. Pricing, rotation, encryption, cross-account access, and the decision criteria for picking each, including the hybrid pattern most production accounts end up at.
Read the guideAWS Clean Rooms: Privacy-Preserving Collaborative Analytics Without Sharing Raw Data
AWS Clean Rooms: analyze together without sharing raw rows. July 2026: 5-member default, C3R crypto, analysis rules checklist.
Read the guideAWS KMS Post-Quantum Cryptography: ML-KEM Hybrid TLS and ML-DSA Signatures in Production
AWS KMS ML-KEM hybrid TLS + ML-DSA signatures. July 2026: when to enable PQC, performance, migration checklist for HNDL risk.
Read the guideAWS EBS Encryption and Snapshot Hygiene: Default Encryption, Public Snapshot Prevention, and KMS Key Lifecycle
EBS default encryption per Region, CMK lifecycle, block public snapshots. July 2026 baseline checklist. Retrofit is expensive.
Read the guideAmazon Macie + Detective on AWS: Data Security Posture Management and Forensic Investigation in Production
Macie + Detective: S3 DSPM and forensic graphs. July 2026: scope costs, KMS decrypt, paired Security Hub pipeline.
Read the guideServices and neighbouring hubs
The engagements that apply these guides, in navy, and the hubs buyers usually read alongside this one.
AWS Security Consulting
AWS security consulting from an AWS Select Tier Partner. 2-week assessment, 4–6 week remediation, zero disruption. IAM hardening, public exposure, compliance gaps, and continuous monitoring.
Explore the serviceCloud Compliance Services — HIPAA, SOC 2, PCI DSS on AWS
Cloud compliance services — HIPAA, SOC 2, PCI DSS, ISO 27001, GDPR. Expert consulting from FactualMinds.
Explore the serviceThreat Detection & Response
Continuous monitoring, Security Hub AI inventory, agentless vulnerability scanning, OCSF data lakes, and automated remediation.
Open the hubCompliance Frameworks
Framework-by-framework guidance — what auditors expect, what AWS provides, and what your team configures.
Open the hubAI Security
Know every AI asset across accounts, then harden inference: prompt injection, PII leakage, hallucinations, and regulated model deployment.
Open the hubCommon questions
- Is Amazon Macie worth the cost vs S3 Block Public Access alone?
- Block Public Access prevents accidental exposure; Macie tells you what would have been exposed. The two answer different questions. Macie continuously discovers and classifies sensitive data (managed identifiers for ~140 PII/PHI/PCI categories plus custom regex, keyword, and ML-based classifiers) across your S3 estate, surfaces unencrypted or publicly accessible buckets containing sensitive data, and feeds findings to Security Hub. The cost — buckets evaluated daily plus per-GB job-based scans — is meaningful at petabyte scale, so most teams scope Macie to known-sensitive prefixes (production application data, backups, data-lake landing zones) rather than the full account. For HIPAA/PCI/GDPR scope, Macie is the cheapest credible "where is the regulated data?" answer.
- Should we have deployed post-quantum crypto by now?
- For long-lived ciphertexts and signatures, yes — as of mid-2026, the AWS PQC features that matter are GA. KMS, ACM, and Secrets Manager now negotiate ML-KEM-1024 hybrid TLS by default for the AWS SDKs that support it — turn it on for any data flow that protects information with a >5-year sensitivity horizon (financial records, healthcare records, intelligence, IP, long-term archives) because of the "harvest now, decrypt later" risk. ML-DSA digital signatures in KMS are GA for code-signing and document-signing workflows where signature longevity matters. For ephemeral request/response traffic, classical ECDHE is still acceptable until 2030+, but most teams find the hybrid mode adds no measurable latency and avoids a future migration sprint.
- Secrets Manager vs Parameter Store SecureString — which to pick?
- Secrets Manager when you need rotation. Parameter Store SecureString when you do not. Secrets Manager bundles automatic rotation Lambdas (RDS, Aurora, DocumentDB, Redshift, Redshift Serverless, single-user/multi-user templates) and replication across regions; you pay per secret per month plus per API call. Parameter Store SecureString is free for standard parameters (up to 4 KB, 10K parameters per region); rotation is a DIY EventBridge-scheduled Lambda. Most teams run a hybrid: Secrets Manager for database credentials and third-party API keys that need rotation; Parameter Store for non-secret config (feature flags, region lists, ARNs) and the SecureString tier for low-rotation tokens. Both integrate with KMS and CloudTrail for evidence.
Apply this to your environment
Our consulting engagements apply this guidance to your specific environment, regulatory scope and threat model.
Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.
.jpg){kind=link}