thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Advanced

Envelope Encryption

Encrypting data with a data key and then encrypting that data key with a separate master key (key encryption key).

Definition

Envelope encryption lets large data be encrypted locally and efficiently with a unique data key, while only the small data key is sent to the KMS for encryption under a master key that never leaves the KMS. The encrypted data key is stored alongside the ciphertext. Cloud services use it for storage encryption with AWS KMS, Azure Key Vault and Cloud KMS.

Example

aws kms generate-data-key returns a plaintext data key for encrypting a file and an encrypted copy to store with it.

Exam tip

KMS master keys encrypt data keys, not bulk data; rotating the master key does not require re-encrypting all data.

Related terms