AWS Cloud Architecture•Part 5: Security, IAM, Messaging & Enterprise Deployments (51 - 65)
AWS KMS Envelope Encryption.
In Simple Words: KMS uses a two-tier key model:
- A Customer Managed Key (KMS CMK) encrypts a small plaintext Data Key.
- The application uses the plaintext Data Key to encrypt large data payloads locally.
- The plaintext key is wiped from memory, and the Encrypted Data Key is stored alongside the encrypted data. Protects data without sending gigabytes across KMS network APIs.
typescript
import { KMSClient, GenerateDataKeyCommand } from "@aws-sdk/client-kms";
// Requesting Data Key from KMS:
const kms = new KMSClient({});
const dataKey = await kms.send(new GenerateDataKeyCommand({
KeyId: "arn:aws:kms:us-east-1:123456789:key/my-key-id",
KeySpec: "AES_256"
}));
// dataKey.Plaintext -> used to encrypt data locally
// dataKey.CiphertextBlob -> stored next to encrypted file