An application encrypts large objects before storing them in S3.
Do not send the entire object directly to KMS, while retaining key auditing and rotation.
Which method is most appropriate?
Use envelope encryption: encrypt the object with a data key and protect that data key with a KMS key.
Detailed explanation
Envelope encryption efficiently protects large data while KMS manages the wrapping key.
Envelope encryption efficiently protects large data while KMS manages the wrapping key.
DNS records are not a secure secret-key store.
DNS records are not a secure secret-key store.
Large application data is normally encrypted with a data key rather than sent wholesale to KMS.
Large application data is normally encrypted with a data key rather than sent wholesale to KMS.
Access control alone does not protect content if stored data is exposed.
Access control alone does not protect content if stored data is exposed.
Check official documentation
Compare the following points with the official documentation.
AWS KMS envelope encryptionの公式説明を確認する。
What to confirm
KMSキーとデータキーの役割を分けて説明できる。
Key points
- AWS KMS
- Data key
- Envelope encryption
Notes
- Environment: AWS公式KMSドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Scale
A data key avoids sending a large object through the KMS API.
Key management
KMS can audit and rotate the wrapping key while the application encrypts the payload.