Envelope encryption

In the previous case, using CMK to encrypt data has its own limitation related to the size of data that we can encrypt.

The encryption process

In this approach, instead of using CMK to directly encrypt our data, we generate a data key from CMK. This data key will be used to encrypt and decrypt our data.

The new data key can be generated with the help of the KMS generate data key operation. Using this operation, AWS KMS will return two values: the plaintext version of the data key and the ciphertext version of the data key:

We use the Plain Text Data version of the data key to encrypt our data for obtaining the Cipher Text Data:

Once the data is encrypted, we delete the plaintext data key and store the encrypted data along with the ciphertext data key in the Storage device:

The decryption process

During the decryption process, we decrypt the ciphertext data key with the help of KMS CMK and obtain the plaintext version of the data key.

This data key can then decrypt the ciphertext...