5.2 Design and implement controls that provide confidentiality and integrity for data at rest. - In this episode, we dive deep into Task Statement 5.2 of the AWS Certified Security - Specialty SCS-C02 Exam Guide, focusing on how to design controls that ensure data at rest within AWS remains confidential and maintains integrity. Listeners will learn the in-depth differences and use cases for symmetric and asymmetric encryption, as well as practical strategies for both server-side and client-side encryption across services like S3, RDS, DynamoDB, SQS, EBS, and EFS. We break down essential integrity measures, such as hashing, digital signatures, and versioning, alongside critical resource policies and IAM roles to control access and enforce the principle of least privilege. The discussion not only highlights regulatory compliance requirements and auditing practices with tools like CloudTrail and AWS Config but also covers advanced scenarios, including using CloudHSM for high-security environments. Real-world examples help solidify concepts, demonstrating secure configurations for finance, healthcare, e-commerce, and machine learning workloads. Perfect for AWS engineers and exam candidates, this episode equips you with the knowledge and actionable skills to design robust, scalable, and compliant controls for data protection in your AWS environment.