AWS Envelop Encryption

First we will learn what is encryption, Encryption is the process of scrambling readable data (plaintext) into an unreadable code (ciphertext) using an algorithm and a secret key, preventing unauthorized access.

In AWS, the KMS service manages encryption, specifically for data at rest. This service encrypts data only if its size is less than 4 KB. For data larger than 4 KB, KMS uses envelope encryption.

How AWS Encryption and Decryption works works:

For data size less than 4 kb KMS will take care of the encryption process.

1. AWS SDK/CLI calls the encrypt API with the secret data.
2. KMS validates the IAM permissions for the user to perform the API.
3. If the user has permission, KMS encrypts the data and sends the encrypted data.
4. During decryption, AWS SDK/CLI calls the decrypt API with the encrypted data.
5. KMS validates the IAM permissions for the user to perform the API.
6. If the user has permission, KMS decrypts the data and sends the decrypted data.
7. AWS KMS manages the encryption/decryption key if we use keys stored in KMS.

How AWS Envelope Encryption works:

KMS Encrypt API call has a limit of 4 KB. If you want to encrypt >4 KB, we need to use Envelope Encryption

Encryption:

1. This time we want to encrypt a big file ie, more than 4KB file.
2. We are going to use the SDK to call the GenerateDataKey API by specifying CMK.
3. If the requester has the permission, KMS will provide 2 keys, plaintext DEK and encrypted DEK.
4. SDK will encrypt the secret file with the plaintext DEK.
5. Finally SDK will create an single Final file which has encrypted secret file and encrypted DEK.

Decryption:

1. During decryption AWS SDK will call the Decrypt API with the envelop file.
2. If the requester has the permission, KMS will decrypt the encrypted DEK part of the envelop file using KMS CMK, and send the plaintext data key.
3. AWS SDK will decrypt the encrypted file.