Using Vanta and AWS for secrets management and encryption

This blog is part of a series about how to use Vanta and AWS to simplify your organization’s cloud security. To learn more about how to use Vanta and AWS, watch our Coffee and Compliance on-demand webinar.

‍

Amazon Web Services, or AWS, is one of the most popular cloud providers for organizations today — providing one of the most flexible and secure cloud environments available. When it comes to security, AWS has what’s called a Shared Responsibility Model meaning that AWS handles the security of the cloud itself while its customers are responsible for securing what they deploy to their cloud environment. 

‍

In this model, AWS secures the physical infrastructure, the facilities, control plane, and the building blocks while customers must secure the workloads and applications that they deploy to the cloud. This is where the AWS integration with Vanta makes a huge difference in how you secure and manage your cloud deployments. 

‍

In this blog series, we’ll show you how to use Vanta to help you secure the portions of your cloud environment that AWS customers are responsible for. For this post, we’ll cover secrets management and cryptography within AWS and how Vanta can make demonstrating compliance here easier. 

‍

How to manage secrets and encryption in AWS

Secrets management and cryptography is a method for managing authentication credentials to ensure the secure storage, distribution, and use of this sensitive information using API keys, passwords, and certificates. Given how critical it is for these credentials to remain confidential to protect your infrastructure, this is an important aspect of your cloud security. Amazon offers advanced tooling that can help AWS customers manage this. 

‍

AWS Key Management Service (KMS) is a managed service that makes it easy to create and control the cryptographic keys that are used to protect your data. KMS uses hardware security modules (HSM) to protect and store your KMS keys. AWS supports custom key stores and optional KMS features to create keys backed by key material that is generated and used outside of KMS. AWS also allows you to import key material.

‍

AWS supports two secret management services: AWS Parameter Store and AWS Secrets Manager. AWS Parameter Store is best used for configuration data and non-sensitive secrets. While AWS Secrets Manager can be used to store sensitive secrets, rotate secrets, cross-account access and integration with other AWS services. 

‍

How Vanta can help with secrets management 

Vanta integrates with various AWS products to help you automate management of your cloud security posture. Some of these areas include:

• Identity and access management
• Vulnerability assessment
• Continuous monitoring of the environment
• Remediation alerts
• Compliance reports for common standards

‍

Vanta can be particularly helpful with this aspect in terms of attaining or maintaining SOC 2 compliance. With a SOC 2, you’re essentially demonstrating a commitment to your customers that critical data stores are protected throughout their lifecycle. However, your auditor doesn’t need to see every detail of your encryption implementation, they just need to see enough proof that sensitive data is encrypted at rest and in transit to make that claim effectively. 

‍

Vanta can help you provide your auditor with the exact evidence they need. The Vanta platform has filters that enable you to sort information as needed so you can show your auditor that your data stores,  databases, and S3 buckets are all encrypted both at rest and in transit. If they are not, the platform will also notify you of this so that you can correct this and stay in compliance. 

‍

There are also other frameworks, such as ISO 27001 and PCI DSS, where you need to demonstrate the fulfillment of additional requirements around the governance of cryptographic keys. Vanta offers helpful templates and guidelines you can use to build a governance program and enables you to easily provide evidence for your audit. 

‍

To learn more about how to use Vanta and AWS, watch our Coffee and Compliance webinar recording.