View a markdown version of this page

Data encryption in AWS Quick - AWS Quick
Encryption at restEncryption in transit

Data encryption in AWS Quick

AWS Quick uses the following data encryption features:

  • Encryption at rest

  • Encryption in transit

  • Key management

You can find more details about data encryption at rest and data encryption in transit in the following topics. For more information about key management in AWS Quick, see Encrypting your AWS Quick data with AWS Key Management Service customer managed keys.

Encryption at rest

AWS Quick securely stores your AWS Quick metadata. This includes the following:

  • AWS Quick user data, including AWS Quick user names, email addresses, and passwords. AWS Quick administrators can view user names and emails, but each user's password is completely private to each user.

  • Minimal data necessary to coordinate user identification with your Microsoft Active Directory or identity federation implementation (Federated Single Sign-On (IAM Identity Center) through Security Assertion Markup Language 2.0 (SAML 2.0)).

  • Data source connection data.

  • AWS Quick encrypts your data source credentials (username and password) and OAuth tokens with your default customer managed KMS key when one is registered with AWS Quick. AWS Quick re-encrypts credentials and tokens with the current default customer managed KMS key each time you update the credential or refresh an OAuth token. If you do not register a default customer managed KMS key, AWS Quick encrypts this information with a service-managed key.

  • Names of your uploaded files, data source names, and data set names.

  • Statistics that AWS Quick uses to populate machine learning (ML) insights.

  • Data indexed to support Amazon Q in Quick. This includes the following:

    • Topics

    • Metadata related to your dashboards

    • Your first index capacity purchase

    • Your first chat

    • Your first space creation

    • Your first knowledge base creation

Important

Quick protects data indexed to support Amazon Q with the Amazon Q data key. That key is set the first time Amazon Q data is created in your account and cannot be changed afterward. To use a customer managed KMS key for Amazon Q data, register it as your account default key before creating any Amazon Q data. For more information, see Amazon Q data key and Customer managed KMS key scope.

AWS Quick securely stores your AWS Quick data. This includes the following:

  • When no customer managed KMS key applies, data at rest in SPICE is encrypted using hardware block-level encryption with keys that AWS owns and manages. For information about using a customer managed KMS key with SPICE datasets, see Customer managed KMS key scope.

  • When no customer managed KMS key applies, other data at rest is encrypted with a service-managed key. This includes the following:

    • Sample values for filters.

    • User feedback on chat responses, including optional free-text comments. User feedback is not encrypted with your customer managed KMS key or the Amazon Q data key.

    Report artifacts (including email reports) can be encrypted with your default customer managed KMS key when one is registered. For more information, see Customer managed KMS key scope.

  • AWS Quick encrypts cached query results at rest. AWS Quick caches query results from a SPICE dataset that your customer managed KMS key protects under that same key, and encrypts other cached results with a service-managed key.

When you delete a user, AWS Quick permanently deletes that user's metadata. What happens to the assets that the user owned, and to data such as the user's conversation history, depends on how the user is removed. For more information, see User lifecycle and data handling in AWS Quick.

When you unsubscribe from AWS Quick, all of your AWS Quick data is completely and permanently deleted. This includes all metadata, any data you have in SPICE, and Amazon Q data, including the Quick index. This deletion is immediate; there is no retention period during which the data can be recovered.

Encryption in transit

AWS Quick supports encryption for all data transfers. This includes transfers from the data source to SPICE, or from SPICE to the user interface. However, encryption isn't mandatory. For some databases, you can choose whether transfers from the data source are encrypted or not. AWS Quick secures all encrypted transfers by using Secure Sockets Layer (SSL).