The "Cloud Native" Default
Think of encryption like a safe-deposit box at a bank. The bank stores your valuables, but they also hold a master key that can open your box if a court orders it. Most cloud encryption works the same way: the cloud provider encrypts your data, but they also hold the keys. This is convenient and fast, but it means you are trusting the provider completely.
When you enable encryption on AWS S3, Azure Blob Storage, or Google Cloud Storage with default settings, the cloud provider generates, stores, and manages the encryption keys on your behalf. This is called provider-managed encryption (sometimes labeled SSE — Server-Side Encryption). Your data is encrypted at rest, which protects against physical disk theft, but the provider can decrypt it whenever they need to — including when compelled by law.
- Trust model: You trust Amazon, Microsoft, or Google implicitly. Their security posture becomes your security posture.
- Risk: If a government agency subpoenas the cloud provider, the provider has both the ciphertext (your data) and the keys to decrypt it. They can comply fully without your knowledge or consent.
Why Regulated Industries Push Back
Banks, healthcare organizations, defense contractors, and government agencies often operate under legal frameworks — GDPR, HIPAA, FedRAMP, Swiss banking law — that require data sovereignty: a provable guarantee that only the data owner can decrypt the data. "We trust Amazon" is not a legally defensible answer in a Swiss court.
This tension between cloud convenience and cryptographic control has produced a spectrum of architectures, each trading performance and operational simplicity for increasing levels of key ownership. Understanding where each model sits on that spectrum — and what it actually guarantees — is the core skill this lesson builds.