How do you use encryption in cloud systems?

Direct answer

What a strong answer covers

How it works

Encryption in transit means TLS everywhere, including between internal services, with certificates issued and rotated automatically. Encryption at rest uses the provider’s managed encryption with keys held in a KMS, where envelope encryption separates the data keys that encrypt objects from the key-encryption keys that never leave the service. Key policies restrict which identities may use each key for which operations, every use is logged, rotation happens on a schedule without re-encrypting data because of envelope encryption, backups are encrypted with keys that survive the primary’s loss, and the design anticipates revocation, so deleting a key makes its data unrecoverable on purpose.

Example

Customer documents are stored in S3 with SSE-KMS under a customer-managed key per tenant; the key policy allows only the document service’s role to decrypt, and CloudTrail shows every decrypt call with the tenant. Deleting a tenant schedules deletion of their key, which renders their objects unreadable even in backups. Internal gRPC traffic uses mTLS with certificates from the mesh, rotated every 24 hours.

Common mistakes

• Relying on default encryption while granting every role kms:Decrypt on every key.
• Storing backups encrypted with a key kept in the same region that could be lost.
• Terminating TLS at the edge and sending plaintext across the internal network.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.