implementing-envelope-encryption-with-aws-kms

What problem does it solve?

Encrypting large volumes of data directly with AWS KMS is limited to 4 KB per request and requires a network round-trip for every operation. This Skill guides the implementation of envelope encryption, where data is encrypted locally with a data encryption key (DEK) and only the DEK is protected by a KMS-managed master key.

Core Features & Use Cases

• DEK Generation and Storage: Call the KMS GenerateDataKey API to obtain a plaintext and encrypted DEK, encrypt data locally with AES-256-GCM, and store only the encrypted DEK alongside the ciphertext.
• Misconfiguration Detection: Identify overly broad KMS key policies, missing encryption contexts, plaintext DEK persistence, and missing CloudTrail logging or key rotation.
• Key Lifecycle Management: Implement DEK caching to reduce KMS API calls, handle key rotation with re-encryption, and support multi-region encryption for disaster recovery.
• Use Case: When building an application that stores sensitive records in AWS, use this Skill to encrypt each record locally with a unique DEK bound to an encryption context, so a compromised role cannot replay ciphertexts against other objects.

Quick Start

Implement envelope encryption for my application using AWS KMS GenerateDataKey and verify that decryption fails when the encryption context does not match.