Runbook 01 Build Enterprise Data Protection & Encryption

Module: 06 – Data Protection & Encryption

Enterprise Lab: 01

Estimated Time: 3–4 Hours

Difficulty: ⭐⭐⭐⭐☆

Estimated Cost: AWS Free Tier (Some services such as AWS KMS, Secrets Manager, ACM, and RDS may incur charges. Always review AWS Pricing and monitor AWS Cost Explorer.)

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, your responsibility is to implement enterprise-grade encryption and data protection controls across AWS services.

By completing this runbook, you will learn how to:

Create AWS KMS Customer Managed Keys (CMKs)
Configure Key Rotation
Encrypt Amazon S3 Buckets
Encrypt Amazon EBS Volumes
Encrypt Amazon RDS Databases
Configure AWS Secrets Manager
Configure Secret Rotation
Configure AWS Certificate Manager (ACM)
Implement encryption for data at rest
Implement encryption for data in transit
Validate enterprise encryption controls

🏢 Business Scenario

CloudNova Technologies is launching a new online payment platform that processes confidential customer information and financial transactions.

To comply with PCI DSS, ISO 27001, and company security standards, all sensitive data must be encrypted both at rest and in transit. Application secrets must be securely managed, and cryptographic keys must follow enterprise key management practices.

As the Cloud Security Engineer, you are responsible for implementing and validating the organization’s encryption strategy before the application is deployed to production.

📋 Prerequisites

Complete:

Module 01 – AWS Security Foundations
Module 02 – Identity & Access Management (IAM)
Module 03 – AWS Organizations
Module 04 – Amazon VPC & Network Security
Module 05 – Amazon EC2 Security

Required:

AWS Account
Administrator Access
Existing EC2 Environment
Existing VPC
AWS CLI Installed
Visual Studio Code

🏗 Enterprise Architecture

                    Users
                      │
                HTTPS (TLS 1.2+)
                      │
            Application Load Balancer
                      │
                Amazon EC2 Instance
                      │
        AWS Secrets Manager (Credentials)
                      │
             AWS KMS Customer Managed Key
              ┌──────────┼──────────┐
              │          │          │
              ▼          ▼          ▼
         Amazon S3   Amazon EBS   Amazon RDS
        (SSE-KMS)   (Encrypted)  (Encrypted)
                      │
            AWS Certificate Manager
                      │
             TLS Certificates (HTTPS)

Step 1 — Create a Customer Managed Key (CMK)

Navigate to:

AWS Console

↓

AWS Key Management Service (KMS)

↓

Customer Managed Keys

↓

Create Key

Configuration

Key Type

Symmetric

Key Usage

Encrypt and Decrypt

Alias

alias/cloudnova-production-key

AWS CLI

aws kms create-key \
--description "CloudNova Production Encryption Key"

Create an alias:

aws kms create-alias \
--alias-name alias/cloudnova-production-key \
--target-key-id <key-id>

Step 2 — Enable Automatic Key Rotation

Navigate to:

AWS KMS

↓

Customer Managed Keys

↓

Key Rotation

Enable:

Automatic Annual Key Rotation

AWS CLI

aws kms enable-key-rotation \
--key-id <key-id>

Discuss:

Why key rotation is important
Compliance requirements
Limiting cryptographic risk

Step 3 — Encrypt an Amazon S3 Bucket

Navigate to:

Amazon S3

↓

Create Bucket

↓

Properties

↓

Default Encryption

Configure:

Encryption

SSE-KMS

AWS KMS Key

alias/cloudnova-production-key

AWS CLI

aws s3api put-bucket-encryption \
--bucket cloudnova-secure-data \
--server-side-encryption-configuration '{
  "Rules":[{
    "ApplyServerSideEncryptionByDefault":{
      "SSEAlgorithm":"aws:kms"
    }
  }]
}'

Validate:

Upload a sample file
Verify encryption is enabled

Step 4 — Encrypt Amazon EBS Volumes

Navigate to:

EC2

↓

Volumes

Verify:

Encryption

Enabled

If creating a new volume:

Enable Encryption
Select the Customer Managed Key

AWS CLI

aws ec2 describe-volumes

Discuss:

Encryption at Rest
Customer Managed Keys
Compliance Requirements

Step 5 — Create an Encrypted Amazon RDS Database

Navigate to:

Amazon RDS

↓

Create Database

Configuration

Storage Encryption

Enabled

AWS KMS Key

alias/cloudnova-production-key

Validate:

Database encryption status
KMS Key association

AWS CLI

aws rds create-db-instance

Step 6 — Store Secrets in AWS Secrets Manager

Navigate to:

AWS Secrets Manager

↓

Store a New Secret

Create:

Database Username

Database Password

API Keys

Application Secrets

AWS CLI

aws secretsmanager create-secret \
--name CloudNovaDatabaseCredentials \
--secret-string '{"username":"admin","password":"ChangeMe123!"}'

Discuss:

Why secrets should never be stored in code
Secret lifecycle management
Centralised credential management

Step 7 — Configure Automatic Secret Rotation

Navigate to:

Secrets Manager

↓

Rotation

Enable:

Automatic Rotation

30 Days

Review:

Rotation Lambda
Rotation Schedule
Validation

Step 8 — Request a TLS Certificate

Navigate to:

AWS Certificate Manager

↓

Request Certificate

Create:

Domain

cloudnova.example.com

Validation

DNS

AWS CLI

aws acm request-certificate \
--domain-name cloudnova.example.com \
--validation-method DNS

Validate:

Certificate Issued
DNS Validation Successful

Step 9 — Configure HTTPS Encryption

Attach the ACM certificate to:

Application Load Balancer
CloudFront (optional)

Validate:

HTTPS access
TLS certificate
Secure browser connection

Discuss:

Encryption in Transit
TLS Certificates
Secure Communications

Step 10 — Validate Encryption

Verify:

Customer Managed Key created
Key Rotation enabled
S3 encrypted
EBS encrypted
RDS encrypted
Secrets stored securely
Secret Rotation enabled
ACM certificate issued
HTTPS functioning correctly

Useful CLI Commands:

aws kms list-keys

aws s3api get-bucket-encryption \
--bucket cloudnova-secure-data

aws secretsmanager list-secrets

aws acm list-certificates

🧪 Enterprise Challenge

CloudNova Technologies is preparing to launch a healthcare platform that stores patient records.

Design a complete enterprise encryption strategy that includes:

Customer Managed Keys
Multi-service encryption
Secrets Manager
Certificate Management
Secure API communication
Key Rotation
Separation of Duties
Least Privilege IAM Access
Compliance with PCI DSS and HIPAA requirements

Explain how your encryption strategy protects sensitive information throughout its lifecycle.

📄 Deliverables

Capture screenshots of:

AWS KMS Key
Key Rotation
S3 Bucket Encryption
EBS Encryption
RDS Encryption
Secrets Manager
Secret Rotation
ACM Certificate
HTTPS Validation

Submit:

Encryption Architecture Diagram
Encryption Configuration Report
Key Management Strategy
Validation Report

🧹 Cleanup

Delete:

Test Secrets
Test Certificates (if no longer required)
Temporary S3 Buckets
Temporary RDS Database
Temporary EBS Volumes

Keep:

Customer Managed Key
IAM Policies
Encryption Documentation
Architecture Diagram

Review AWS Cost Explorer to ensure no unnecessary resources remain.

✅ Runbook Checklist

💡 Lessons Learned

What did you learn?

Why are Customer Managed Keys preferred over AWS Managed Keys in enterprise environments?

Why should application secrets be stored in AWS Secrets Manager instead of source code?

How do encryption at rest and encryption in transit protect sensitive data?

How would you improve the encryption strategy for a production environment?

🚀 Next Enterprise Runbook

Enterprise Runbook 02 — Enterprise Data Protection Security Assessment

In the next runbook, you will assess an enterprise AWS environment by reviewing KMS configuration, encryption across AWS services, key rotation, IAM permissions, Secrets Manager, ACM certificates, and compliance with enterprise data protection standards.