# Data encryption in Amazon FSx for Lustre
Amazon FSx for Lustre supports two forms of encryption for file systems, encryption of data at rest and encryption in transit. Encryption of data at rest is automatically enabled when creating an Amazon FSx file system. Encryption of data in transit is automatically enabled when you access an Amazon FSx file system from [Amazon EC2 instances](https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/data-protection.html#encryption-transit) that support this feature.
## When to use encryption
If your organization is subject to corporate or regulatory policies that require encryption of data and metadata at rest, we recommend creating an encrypted file system and mounting your file system using encryption of data in transit.
For more information about creating a file system encrypted at rest using the console, see [Create your Amazon FSx for Lustre file system](getting-started.md#getting-started-step1).
**Topics**
+ [When to use encryption](#whenencrypt)
+ [Encrypting data at rest](encryption-at-rest.md)
+ [Encrypting data in transit](encryption-in-transit-fsxl.md)
# Encrypting data at rest
Encryption of data at rest is automatically enabled when you create an Amazon FSx for Lustre file system through the Amazon Web Services Management Console, the Amazon CLI, or programmatically through the Amazon FSx API or one of the Amazon SDKs. Your organization might require the encryption of all data that meets a specific classification or is associated with a particular application, workload, or environment. If you create a persistent file system, you can specify the Amazon KMS key to encrypt the data with. If you create a scratch file system, the data is encrypted using keys managed by Amazon FSx. For more information about creating a file system encrypted at rest using the console, see [Create your Amazon FSx for Lustre file system](getting-started.md#getting-started-step1).
**Note**
The Amazon key management infrastructure uses Federal Information Processing Standards (FIPS) 140-2 approved cryptographic algorithms. The infrastructure is consistent with National Institute of Standards and Technology (NIST) 800-57 recommendations.
For more information on how FSx for Lustre uses Amazon KMS, see [How Amazon FSx for Lustre uses Amazon KMS](#FSXKMS).
## How encryption at rest works
In an encrypted file system, data and metadata are automatically encrypted before being written to the file system. Similarly, as data and metadata are read, they are automatically decrypted before being presented to the application. These processes are handled transparently by Amazon FSx for Lustre, so you don't have to modify your applications.
Amazon FSx for Lustre uses industry-standard AES-256 encryption algorithm to encrypt file system data at rest. For more information, see [Cryptography Basics](https://docs.amazonaws.cn/kms/latest/developerguide/crypto-intro.html) in the *Amazon Key Management Service Developer Guide*.
## How Amazon FSx for Lustre uses Amazon KMS
Amazon FSx for Lustre encrypts data automatically before it is written to the file system, and automatically decrypts data as it is read. Data is encrypted using an XTS-AES-256 block cipher. All scratch FSx for Lustre file systems are encrypted at rest with keys managed by Amazon KMS. Amazon FSx for Lustre integrates with Amazon KMS for key management. The keys used to encrypt scratch file systems at-rest are unique per file system and destroyed after the file system is deleted. For persistent file systems, you choose the KMS key used to encrypt and decrypt data. You specify which key to use when you create a persistent file system. You can enable, disable, or revoke grants on this KMS key. This KMS key can be one of the two following types:
+ **Amazon managed key for Amazon FSx** – This is the default KMS key. You're not charged to create and store a KMS key, but there are usage charges. For more information, see [Amazon Key Management Service pricing](http://www.amazonaws.cn/kms/pricing/).
+ **Customer managed key** – This is the most flexible KMS key to use, because you can configure its key policies and grants for multiple users or services. For more information on creating customer managed keys, see [Creating keys](https://docs.amazonaws.cn/kms/latest/developerguide/create-keys.html) in the* Amazon Key Management Service Developer Guide.*
If you use a customer managed key as your KMS key for file data encryption and decryption, you can enable key rotation. When you enable key rotation, Amazon KMS automatically rotates your key once per year. Additionally, with a customer managed key, you can choose when to disable, re-enable, delete, or revoke access to your customer managed key at any time.
**Important**
Amazon FSx accepts only symmetric encryption KMS keys. You can't use asymmetric KMS keys with Amazon FSx.
### Amazon FSx key policies for Amazon KMS
Key policies are the primary way to control access to KMS keys. For more information on key policies, see [Using key policies in Amazon KMS](https://docs.amazonaws.cn/kms/latest/developerguide/key-policies.html) in the *Amazon Key Management Service Developer Guide. *The following list describes all the Amazon KMS–related permissions supported by Amazon FSx for encrypted at rest file systems:
+ **kms:Encrypt** – (Optional) Encrypts plaintext into ciphertext. This permission is included in the default key policy.
+ **kms:Decrypt** – (Required) Decrypts ciphertext. Ciphertext is plaintext that has been previously encrypted. This permission is included in the default key policy.
+ **kms:ReEncrypt** – (Optional) Encrypts data on the server side with a new KMS key, without exposing the plaintext of the data on the client side. The data is first decrypted and then re-encrypted. This permission is included in the default key policy.
+ **kms:GenerateDataKeyWithoutPlaintext** – (Required) Returns a data encryption key encrypted under a KMS key. This permission is included in the default key policy under **kms:GenerateDataKey\$1**.
+ **kms:CreateGrant** – (Required) Adds a grant to a key to specify who can use the key and under what conditions. Grants are alternate permission mechanisms to key policies. For more information on grants, see [Using grants](https://docs.amazonaws.cn/kms/latest/developerguide/grants.html) in the *Amazon Key Management Service Developer Guide.* This permission is included in the default key policy.
+ **kms:DescribeKey** – (Required) Provides detailed information about the specified KMS key. This permission is included in the default key policy.
+ **kms:ListAliases** – (Optional) Lists all of the key aliases in the account. When you use the console to create an encrypted file system, this permission populates the list to select the KMS key. We recommend using this permission to provide the best user experience. This permission is included in the default key policy.
# Encrypting data in transit
Scratch 2 and persistent file systems can automatically encrypt data in transit when the file system is accessed from Amazon EC2 instances that support encryption in transit, and also for all communications between hosts within the file system. To learn which EC2 instances support encryption in transit, see [Encryption in transit](https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/data-protection.html#encryption-transit) in the *Amazon EC2 User Guide*.