Cloud Native Development Patterns and Best Practices

Data at rest

Encrypting data at rest is a fundamental security requirement. However, encrypting data at rest is a much more complicated problem space than encrypting data in transit. For data in transit, we can reasonably take a coarse-grained approach and require that all traffic over all communication channels use SSL. We can do this because communication is a transient event between two parties, where the consumer has been authenticated and its client software is trusted. Encryption at rest is a more complex problem space because once data is stored, there will be many more interactions with many more parties over the life of the data.

Unfortunately, a coarse-grained approach to encrypting data at rest is insufficient. I think it is fair ...