What is envelope encryption in AWS KMS and why is it used?
Envelope encryption encrypts data with a data key, then encrypts that data key with a KMS key. KMS directly handles only small payloads (up to 4 KB), so large data is encrypted locally with the data key, and only the small data key goes to KMS.
Explain it simply
You put your valuables in a suitcase and lock it with a small key. Then you lock that small key inside the bank locker. The bank only deals with the tiny key, not the whole heavy suitcase, yet nobody can open the suitcase without going through the bank.
Example
Encrypt
1. App asks KMS: GenerateDataKey (using KMS key K)
2. KMS returns: plaintext data key + the same key encrypted under K
3. App encrypts the 2 GB file locally with the plaintext data key
4. App throws the plaintext data key away
5. App stores: encrypted file + encrypted data key
Decrypt
1. App sends the encrypted data key to KMS (Decrypt)
2. KMS checks permissions, returns the plaintext data key
3. App decrypts the file locallyBenefits: large data does not travel to KMS, the master KMS key never leaves KMS, and each object can have its own data key. S3 SSE-KMS, EBS and RDS encryption use this pattern behind the scenes.
Access is controlled through IAM and the key policy, and every KMS call is recorded in CloudTrail.
What to say in the interview
"Envelope encryption encrypts data with a data key and then protects that data key with a KMS key. It avoids sending big data to KMS, keeps the master key inside KMS, and is what S3, EBS and RDS encryption use internally."
Common mistakes
- Storing the plaintext data key next to the encrypted data.