VocalHyre
Sign up

AWS, Azure & GCP · Cloud across providers

How does encryption at rest work in the cloud?

Mediumencryptionkmsdata protectionUpdated Oct 2026
Quiz this track

Short answer

Data is encrypted on disk with a data key, and that key is protected by a key management service. You choose provider-managed or customer-managed keys, rotation and access policies.

Most cloud services use envelope encryption: a data key encrypts the object or volume, and a master key in a key management service encrypts the data key. The ciphertext and wrapped key are stored together, and the service calls the KMS to unwrap the key when access is authorised.

Key choices

  • Provider-managed keys: simplest, encrypted by default, limited control over rotation and policy
  • Customer-managed keys: you control key policy, rotation and disabling, and you own the availability risk
  • Customer-provided keys: you supply the key material per request, with the highest operational burden
  • Hardware security modules: stronger key isolation for regulated workloads
bash
aws kms create-key --description "orders at rest"
aws kms enable-key-rotation   --key-id 1234abcd-12ab-34cd-56ef-1234567890ab
Create a customer-managed key and enable automatic rotation.

Encryption at rest protects against physical disk loss and some snapshot exposure. It does not protect against an application with valid credentials reading data it should not. Key policies and identity controls remain the real access boundary.

Encrypt backups, snapshots and replicas too. A common gap is encrypting the primary database but leaving an older snapshot or cross-region copy unprotected.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1What is envelope encryption?
  2. 2What risk do you take on with customer-managed keys?
  3. 3Does encryption at rest stop a compromised application?
  4. 4How do you handle key rotation without downtime?

Say it in the interview

At rest, data is encrypted with a data key, and a KMS master key wraps that data key, which is envelope encryption. I choose provider-managed keys for simplicity or customer-managed keys when I need control over policy and rotation, and I accept the availability risk that comes with owning the key. Encryption at rest protects storage, but identity and key policy still decide who can read the data.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

EasyHow do you encrypt data in transit?MediumHow should you manage secrets in the cloud?MediumWhat are the core cloud security practices?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live AWS, Azure & GCP mock interview and get scored feedback on depth, clarity and confidence.

Start a free AWS, Azure & GCP interviewBrowse all questions