domains / families / security / implementing-envelope-encryption-with-aws-kms

implementing-envelope-encryption-with-aws-kms

separate

Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume.

When to use

• When deploying or configuring implementing envelope encryption with aws kms capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Skill page

Source