[gruez]

>First the data is stored in another country.

Plus you can engage in some jurisdiction arbitrage where all the documents pertaining to country A is stored in country B, and all the documents pertaining to country B is stored in country A.

> Second are they really going to raid and take the drives at an AWS data center that has other customer’s information?

You can also ask AWS to produce the files/documents for you.

[scarface_74]

And those files are hopefully encrypted at rest and probably using a customer managed key…

[gruez]

>using a customer managed key…

Not an AWS expert but how does that even work? Does AWS connect to your HSM remotely? Or is a cloud HSM that's also hosted by AWS?

[scarface_74]

(Source: I am a current high level employee at a third party AWS consulting company and former employee at AWS working in the Professional Services department)

I actually was imprecise with my wording.

A customer managed KMS key is any key that you make instead of using an AWS provided key. AWS still has the means to theoretically decrypt the data.

I am actually referring to a customer managed KMS key where you import your own key material

https://docs.aws.amazon.com/kms/latest/developerguide/import...

There is also CloudHSM

https://aws.amazon.com/cloudhsm/faqs/#:~:text=AWS%20CloudHSM....

I don’t know how far “AWS doesn’t have access to your keys go” when it comes to a government subpoena.

I do know that if anyone accesses anything on your account from AWS, all sorts of internal alarm bells go off at AWS and it would still show up in your CloudTrail logs.

I’m sure there is something that allows internal AWS employees to access your account in unauthorized ways. But I never heard about it in 3.5 years working there in the Professional Services department.