CodeParkUse envelope encryption: KMS gives you a small data key, and you encrypt the big file yourself with that key. You can't send the file to KMS, because the Encrypt API only accepts small payloads of up to 4 KB. KMS keys also never leave KMS. So Encrypt is meant for small secrets and for encrypting other keys.
How it works:
- You call
GenerateDataKey. KMS returns the same data key twice: once in plaintext (readable form), and once encrypted under your KMS key. - You encrypt the file locally with the plaintext data key, for example with AES-GCM.
- You delete the plaintext key from memory.
- You store the encrypted data key next to the ciphertext (the encrypted file).
To decrypt, you send the encrypted data key to the KMS Decrypt API. KMS checks IAM and the key policy, then returns the plaintext data key. You use it locally to decrypt the file.
Why this is good:
- The large data never travels over the network to KMS.
- It is fast.
- Every decryption still goes through KMS, so KMS controls and logs it.
S3 SSE-KMS and EBS encryption use this same pattern internally.
- The KMS
EncryptAPI only handles small payloads, up to 4 KB. GenerateDataKeyreturns the data key twice: in plaintext and encrypted.- You encrypt locally, delete the plaintext key, and store the encrypted key with the data.
- To decrypt, KMS decrypts the data key, and KMS checks the policy and logs each use.
- AWS services like S3 SSE-KMS use the same pattern.
Read more