Encryption and Key Management of Personal Data in Cloud Computing: The Case of Amazon S3 and AWS KMS

Abstract

Cloud computing has enabled individuals and organizations to store growing volumes of personal data efficiently, but it has also reduced users' direct control over storage infrastructure and increased exposure to unauthorized access. This paper examines the protection of cloud-based personal data through envelope encryption and key management, using Amazon S3 and AWS Key Management Service (AWS KMS) as a case study. It addresses the following research question: To what extent can the S3–KMS encryption mechanism reduce personal-data leakage risks, and what factors limit its practical effectiveness? Based on a review of academic literature and AWS technical documentation, the paper analyzes the roles of data encryption keys (DEKs), key encryption keys (KEKs), access permissions, key rotation, and audit logs. The analysis finds that SSE-KMS can reduce the risk that copied stored data will directly disclose personal information by separating encrypted objects from the key encryption keys (KEKs) needed to recover their data encryption keys (DEKs). However, encryption alone cannot prevent breaches caused by stolen credentials, excessive permissions, improper key deletion, or inadequate log monitoring. The paper concludes that effective cloud privacy protection requires a coordinated framework combining encryption, key lifecycle governance, least-privilege access control, and continuous auditing.