Envelope Encryption and Data Keys

KMS can encrypt only small payloads (about 4 KB) directly. Real data, files, volumes, and databases, is far larger.

Envelope encryption solves this: you encrypt your big data with a data key, then encrypt that data key with a KMS key. This is how AWS encrypts everything at scale.

A data key is a normal encryption key (like AES-256) generated by KMS for encrypting your actual data.

• Unlike KMS keys, the data key's plaintext leaves KMS briefly so you can use it.
• KMS also returns an encrypted copy of the data key.

You call GenerateDataKey, naming a KMS key. KMS returns:

• A plaintext data key to encrypt your data immediately.
• An encrypted data key (wrapped by the KMS key) to store alongside the ciphertext.

You then discard the plaintext data key from memory.

The flow is:

• Encrypt data with the plaintext data key.
• Store the encrypted data key next to the ciphertext.
• Throw away the plaintext data key.

The data key is "in an envelope" sealed by the KMS key, hence the name.

To decrypt, you reverse the process:

• Send the encrypted data key to KMS Decrypt.
• KMS returns the plaintext data key.
• Use it to decrypt your data, then discard it.

Only KMS can unwrap the data key, so access to the KMS key controls everything.

Envelope encryption gives the best of both worlds:

• Fast local encryption of large data with the data key.
• Strong central control because the data key is useless without the KMS key.

You also reduce KMS calls, since one data key can protect lots of data.

For high-volume workloads, the AWS Encryption SDK can cache data keys to reuse them across many encryptions.

This cuts KMS request costs and latency, with configurable limits so a cached key is not reused too long or too widely, balancing performance against security.

When you enable encryption on S3, EBS, or RDS, AWS performs envelope encryption for you.

The service requests a data key from your KMS key, encrypts the data, and stores the wrapped data key. You simply pick the KMS key; the envelope mechanics are automatic.

The AWS Encryption SDK is a client-side library that implements envelope encryption correctly in your own apps.

It handles data key generation, encryption context, and storing the wrapped key with the ciphertext, so you do not implement the error-prone crypto plumbing yourself.

A variant, GenerateDataKeyWithoutPlaintext, returns only the encrypted data key.

It is used when you want to generate and store a data key now but decrypt it only later, at the moment of use. This keeps the plaintext key out of memory until it is actually needed, reducing exposure for keys provisioned ahead of time.

Envelope encryption explains why KMS scales and how a single KMS key protects terabytes of data.

Expect questions on the GenerateDataKey flow, what leaves KMS (the data key, briefly), and why controlling the KMS key controls all derived data.

Test the envelope flow.

You learned envelope encryption.

• GenerateDataKey returns a plaintext and an encrypted data key.
• Encrypt data locally with the plaintext key, store the wrapped key, discard the plaintext.
• Only the KMS key can unwrap the data key, giving central control over all data.