AWS › AWS KMS & Data Encryption

How does envelope encryption work in KMS, and why is it used instead of encrypting large amounts of data directly with a KMS key?

Intermediate

Answer

Envelope encryption uses a KMS master key to encrypt a smaller, unique data key, which is then used to actually encrypt your data locally, meaning the potentially large data itself never needs to be sent to KMS for encryption, only the small data key does, significantly improving performance and reducing the number of calls made to KMS compared to encrypting large volumes of data directly through the service itself.

response = kms_client.generate_data_key(KeyId='alias/my-key', KeySpec='AES_256')
plaintext_key = response['Plaintext']
encrypted_key = response['CiphertextBlob']

Real-world example An application encrypting large video files locally generates a unique data key from KMS for each file, encrypts the file using that data key on the local machine, and stores only the small encrypted version of the data key alongside the file, avoiding the need to send massive file contents through KMS itself.

Common follow-ups: What is the size limit for data that can be encrypted directly by a KMS key without envelope encryption?;How is the encrypted data key later used to decrypt the original data?

S3 & Storage;Amazon EFS (Elastic File System)