I want to build an application to save data input from my user in DynamoDB and/or S3. Usually I use API Gateway and Lambda for this. With users authenticated by Cognito.
So far so easy. Now I want this data to be secured in a way, that only the user can read it - not me as the admin/programmer.
How can I do this in the AWS ecosystem? Any key pair that cognito creates and no admin gets, maybe? Is it possible at all?
It is always difficult to block Admin access to data.
For example, think of a company that is storing pay information and personal information about employees. They probably don't want an IT Admin accessing that data but the HR folks don't know how to manage IT infrastructure. Ultimately, somebody with the right skills has to 'have the keys' to the IT infrastructure.
One option is to store sensitive data in a different AWS Account that has minimal access. This doesn't totally solve the problem, but it reduces the number of people who might have access to the data.
To do it fully so that nobody has access to the data, you would need to encrypt the data using a key that only the user knows (eg their password). Decrypting the data would require the password. If a user loses their password, then they have also lost access to their data.