Why do we need it?
AWS KMS keys can be used to encrypt data only up to a size of 4 KB (4096 bytes). In order to encrypt data of size greater than 4 kb in size, a method called, Envelope Encryption is used, which is not specific to AWS.
Should I encrypt application data up to 4 KB in size with AWS KMS keys?
No, you should not. Even though application data up to 4 KB in size can be encrypted with AWS KMS keys, it is not designed to encrypt application data. You can check Encrypting and decrypting data keys for more details.
How does envelope encryption/decryption work?
You request AWS to generate data keys (encrypted and plain text) by providing your KMS key ID e.g. the following CLI command
aws kms generate-data-key --key-id your_kms_key_id_here --key-spec AES_256
will return something like
{
"CiphertextBlob":
"RkIBAHgMxXGERpLXTIIM54OPUp/dXeRYW2ALjX6EVz3skLXeBwG6AEIFFTyHrw6EXSuZxf7gAAAAfjB8Bgkqhk
iG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeDglghkgBZQMEAS4wEQQMqsMiCfXkoxHsHbxfAgEQgDunMIdAh
gNqLaI6QtKnw5UrqQhrPezpLSE0fvkUD4yVpkJp1594C8DV6wBohptgrmSVA8B16xU9VK+cWA==",
"Plaintext": "p7hbvvuIm0Bg2ZMNpXPWqZq5cKjv1bPj23HYA4d/syM=",
"KeyId":
"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
Now, you use the Plaintext
value to encrypt your data and store your encrypted data along with the CiphertextBlob
value. Subsequently, you delete the Plaintext
value.
To decrypt the data: You request AWS to return a Plaintext
value by providing it with your KMS key ID and the CiphertextBlob
value that you have stored with the encrypted data. You use the returned Plaintext
value to decrypt your encrypted data.
Notes:
- Encryption and decryption are done with a
Plaintext
value, not with a CiphertextBlob
value.
- A general practice is to use an alias of a key instead of the key itself i.e. you should replace
your_kms_key_id_here
with an alias. Check this to learn more about alias.
- Check this to learn more about a data key.