Cryptographic Erasure: A Data Deletion Strategy Using AWS KMS

This article was originally written in Japanese and published on Qiita. It has been translated with the help of AI. Original article: https://qiita.com/sassssan68/items/a406e971217c1523026b Are you really sure your data is deleted? With a shift in mindset and AWS KMS, you can effectively achieve data deletion. This article covers: Challenges of traditional data deletion The concept of Cryptographic Erasure How to implement Cryptographic Erasure with AWS KMS Background and Challenges Scenario 1: User Account Deletion Imagine you're running a SaaS service and a user requests to close their account. You need to delete all of that user's data. You might think, "Just run a DELETE statement on the database, right?" But in reality, data exists in many places: Production database ← You can delete here Database backups ← But there are 30 days' worth... Log files ← Stored in S3... Analytics data warehouse ← Copies in Redshift too... Dev/staging environments ← Using masked production data... Dele