AWS encrypting data at rest

Here is good white paper on encrypting data at rest on AWS:
http://media.amazonwebservices.com/AWS_Securing_Data_at_Rest_with_Encryption.pdf

Amazon now offers Amazon EBS native encryption: http://aws.amazon.com/about-aws/whats-new/2014/05/21/Amazon-EBS-encryption-now-available/
S3 has SSE encryption, client side encryption and SSE with key managed by you: http://aws.amazon.com/blogs/aws/s3-encryption-with-your-keys/
All data in Glacier and Redshift is automatically encrypted.

Oracle credentials encrypted and protected in S3

Having worked with Oracle Databases for a very long time, this blog post really caught my interest.   This is great way to insure Oracle credentials are not in scripts, environment variables, programs or other places where they can be read by the naked eye.

This blog post describes how DB credentials could be stored encrypted in S3. The role (IAM role) on the EC2 instance would be used with its short-term security credentials to let the client pull the DB credentials from S3 as needed.

http://blogs.aws.amazon.com/security/post/Tx610S2MLVZWEA/Using-IAM-roles-to-distribute-non-AWS-credentials-to-your-EC2-instances

Security on AWS

Good overview of top security tips for running on AWS:
http://stratumsecurity.com/2012/12/03/practical-tactical-cloud-security-ec2/

S3 and HSM

It is possible to use CloudHSM to encrypt data stored in other AWS services, such as Amazon S3. However, the encryption operations must be handled by your application in conjunction with CloudHSM.

S3 client side encryption

You can build your own library that encrypts your objects data on the client side before uploading it to Amazon S3. Or you can use the AWS provided SDK. Currently, only the AWS SDK for Java supports client-side encryption.

S3 SSE without request header

You must include the provide a request header, x-amz-server-side-encryption.  S3 SSE

 encrypts each object with a unique key.  Unfortunately there is no way to enable SSE for a bucket where SSE happens automatically. There is no such bucket policy or bucket setting.  Some third party tools take care of automatically using SSE, such as S3 browser: http://s3browser.com/amazon-s3-server-side-encryption.php. You can enable encryption for already uploaded files, and it can also be configured to automatically apply encryption during uploading.

AWS RDS database encryption

There a couple of ways to encrypt you data at rest when using AWS RDS:

1. Oracle RDS TDE support : http://aws.amazon.com/about-aws/whats-new/2013/04/18/amazon-rds-oracle-encryption
2. Oracle RDS with Ciphercloud : http://www.ciphercloud.com/database-encryption-and-tokenization.aspx.  AWS specific here (and mentions HIPPA) : http://www.ciphercloud.com/aws-encryption-ciphercloud.aspx

Oracle TDE also supports encryption at the network tier. 

EBS volume encryption

Here are two companies that offer EBS volume encryption:

1. SafeNet ProtectV

     A. Support for boot volume encryption

     B. Good integration with Hardware Security Modules (HSM)

     C. Somewhat limited OS support  

2. Trend Micro SecureCloud

      A. Good support for RAID arrays

      B. Supports IAM roles for EC2 Instances, HSM support 
      C. Support for root volume encryption

           D. Supports AWS Storage Gateway as well as EBS volumes

Encrypting Oracle Databases on AWS

Cipher Cloud offers an alternative to Oracle Transparent Data Encryption (TDE) to encrypt Oracle database tables.http://www.ciphercloud.com. The product specifics can be found here: http://www.ciphercloud.com/database-encryption-and-tokenization.aspx.  It is an option for those customers running Oracle SE or Oracle SE One on EC2 or RDS as TDE is only for Oracle EE. 
Salesforce uses CiperCloud to encrypt the Oracle database. Salesforce runs one of the largest Oracle RAC implementations in the world.