3 ms·

The same way as you. Most of these services support client-side encryption or server-side encryption with customer-managed keys with services like KMS: https://

The same way as you. Most of these services support client-side encryption or server-side encryption with customer-managed keys with services like KMS: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html https://docs.aws.amazon.com/kms/latest/developerguide/concep... Now if you want to get your tinfoil hat on and say "If it's server-side, then what's stopping Amazon from just lying", the answer is independent auditors. You might not be able to get a tour of the inner workings of these services, but multi-billion dollar customers absolutely ask for it and get it under NDA's.

aborsy 4y ago
You are right. I use KMS sometimes, but that’s server side encryption. KMS protects a master key. It doesn’t protect data encryption keys encrypted with that master key. Those keys are exposed outside HSMs, in places like S3 in RAM or sometimes disks. Further, the encryption and decryption of data are done outside HSM. So, I know my disk encrypted with KMS is not protected from AWS. But I guess the audits help here. Also, client side encryption works for things like backups. End to end encryption rules out a lot of features. Therefore lot of companies store data in plaintext (data base, web servers, user facing services etc).