Key Management Service (KMS)

A developer needed to encrypt sensitive data. They generated an AES-256 key and hardcoded it in the application configuration. The key was committed to Git, visible to every developer, stored in plain text on CI/CD servers, and embedded in Docker images pushed to a container registry. When the company was audited for SOC 2 compliance, the auditor asked: "Who has access to the encryption key?" The honest answer was "everyone who has ever cloned the repository."

This is not hypothetical. GitHub's secret scanning service detects over 200 different credential types and found over 10 million secrets leaked in public repositories in 2023 alone.

Encryption is only as strong as the key management. AES-256 is computationally unbreakable. But it is trivially broken if the key is sitting in a Git repository. A Key Management Service (KMS) solves this by centralizing key storage, controlling who can use keys, rotating them automatically, and logging every key operation.

Direct encryption with a KMS-managed key means sending every byte of data to the KMS API. AWS KMS limits you to 4KB per request and charges $0.03 per 10,000 requests. Encrypting a 1GB database backup would require 262,144 API calls, take hours, and cost $0.79. That does not scale.

Envelope encryption solves this:

1. Your application calls KMS: "Generate a data encryption key (DEK) for me"
2. KMS generates a random AES-256 key and returns it twice: once in plaintext, once encrypted with the master key (KEK)
3. Your application encrypts the data locally with the plaintext DEK. This is fast, local, no network calls
4. Your application immediately zeroes the plaintext DEK from memory
5. Your application stores the ciphertext and the encrypted DEK together (same database row, same S3 object metadata)
6. To decrypt later: send the encrypted DEK back to KMS, get the plaintext DEK, decrypt locally

The master key (KEK) never leaves KMS. Your application never sees it. Even if your server is fully compromised, the attacker gets encrypted data and encrypted data keys. Both are useless without active KMS permissions to call the Decrypt API.

Key rotation with envelope encryption. When KMS rotates the master key, old data keys remain decryptable because KMS keeps the old key version. New data keys are encrypted with the new master key version. You do not need to re-encrypt existing data. The rotation is transparent.