Envelope Encryption and Data Keys
See how KMS protects a data key that encrypts your real data.
The Large Data Problem
KMS can encrypt only small payloads (about 4 KB) directly. Real data, files, volumes, and databases, is far larger.
Envelope encryption solves this: you encrypt your big data with a data key, then encrypt that data key with a KMS key. This is how AWS encrypts everything at scale.
What a Data Key Is
A data key is a normal encryption key (like AES-256) generated by KMS for encrypting your actual data.
- Unlike KMS keys, the data key's plaintext leaves KMS briefly so you can use it.
- KMS also returns an encrypted copy of the data key.
All lessons in this course
- What KMS Keys Are and Do
- Symmetric, Asymmetric, and Multi-Region Keys
- Key Policies, Grants, and Conditions
- Envelope Encryption and Data Keys