Envelope Encryption
Data ProtectionEnvelope Encryption is the strategy used by AWS KMS to encrypt data efficiently. Instead of sending all your data to KMS for encryption (which would be slow and expensive), KMS generates a data key, you encrypt your data locally with that data key, then KMS encrypts the data key with your KMS key.
The result is two things stored together: the encrypted data and the encrypted data key (the "envelope"). To decrypt, you send the encrypted data key to KMS, get back the plaintext data key, and decrypt your data locally.
Why Envelope Encryption?
- Performance: encrypt locally with AES-256 instead of sending data over the network to KMS
- Cost: one KMS API call to generate/decrypt the data key, not one per data block
- Security: the master key never leaves KMS; only data keys are exposed (and they are encrypted)
Related AWS Services
Related Terms
A cryptographic key managed by AWS Key Management Service used to encrypt and decrypt data across AWS services, with centralized key policies and automatic rotation.
Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.