Certablo
Sign inCreate account
← Knowledge Base
Security & Identityservice

AWS KMS, Envelope Encryption & Key Access

AWS key management from encryption keys and envelope encryption to key policies, grants, encryption context and the cryptographic choices that matter when services protect data with KMS.

CLF-C02AIF-C01AIP-C01SAA-C03

Visual overview

DEFENSE IN DEPTHIdentity, data, network, detection, and audit controls protect different boundaries
IDENTITYAuthenticate + authorizePrincipals · policies · temporary credentials
DATAEncrypt + protect secretsKeys · certificates · application secrets
DETECT & AUDITFind threats + retain evidenceFindings · API history · configuration state
No single security service replaces the others. Strong AWS security combines preventive, detective, and evidence-producing controls around the workload.
AWS SERVICE MAPKMS security boundary

IAM determines who may request key operations, KMS enforces key policy and cryptography, and CloudTrail records KMS API activity including non-secret encryption context.

IAMCaller permission and policy context
AWS KMSKey authorization and cryptographic operations
CloudTrailAudit evidence for KMS API calls
EXAM-RELEVANT MECHANICS

Technical reference

KMS is easiest to reason about as two layers: cryptographic mechanism and authorization to invoke that mechanism.

Envelope encryptionData key + KMS key

GenerateDataKey can return a plaintext data key for local encryption and a CiphertextBlob containing the same data key encrypted under the KMS key.

Symmetric operationSYMMETRIC_DEFAULT

The common KMS symmetric encryption key spec is used by many AWS service integrations; asymmetric specs expose different algorithm choices.

Direct Encrypt sizeUp to 4,096 bytes

The KMS Encrypt API is intended for small plaintext payloads; use envelope encryption for larger application data.

Primary authorizationKey policy

Every KMS key has exactly one key policy; IAM policies and grants operate within the access model the key policy permits.

DelegationKMS grant

A grant can authorize selected cryptographic operations and can use EncryptionContextEquals or EncryptionContextSubset constraints.

Authenticated metadataEncryptionContext

For symmetric encryption operations, context is AAD and can be referenced by policy conditions; matching context is required for decryption.

Service limits and capabilities can change. Values shown here reflect the current AWS documentation; use the linked official sources below as the source of truth.

KMS separates key control from bulk data encryption

AWS Key Management Service (AWS KMS) creates and controls cryptographic KMS keys used directly by KMS APIs and by integrated AWS services. The key material behind a KMS key is protected inside the KMS security boundary; applications identify the key through its ARN, key ID, or alias rather than retrieving symmetric key material from an ordinary customer-managed KMS key. Customer managed keys give customers policy and lifecycle controls that AWS managed or AWS owned key models expose differently.

For large data, the important pattern is envelope encryption. A short-lived data key encrypts the application data locally or inside an integrated service. That data key is then encrypted under a KMS key. The ciphertext can store the encrypted data key next to the encrypted payload because the encrypted data key is not useful until an authorized Decrypt operation unwraps it. This avoids sending every byte of a large object through the KMS Encrypt API.

Key policies and grants are first-class authorization controls

Every KMS key has a key policy, and AWS describes the key policy as the primary mechanism for controlling access to the key. IAM policies can participate when the key policy allows the account to delegate that authority. This is why adding kms:Decrypt to an IAM role is not always sufficient: the KMS key's authorization model must also make that access possible, and cross-account use requires permission on both sides of the account boundary.

KMS grants provide another authorization instrument, often used by AWS services for delegated or temporary use of a key without continually editing the key policy. A grant can allow selected cryptographic operations and can be constrained. When investigating unexpected access, key policy, IAM policies, grants, and broader explicit-deny guardrails must all be considered rather than treating KMS as a simple IAM-only resource.

Encryption context binds non-secret metadata to cryptographic operations

For symmetric encryption KMS keys, an encryption context is an optional set of non-secret key/value pairs. KMS uses it as additional authenticated data (AAD). If encryption used a particular context, the required matching context must be supplied for decryption. Policies and grant constraints can also test the encryption context, which makes it useful for binding permission to an application, tenant, or resource identifier without putting that identifier inside the ciphertext format.

Encryption context is logged in AWS CloudTrail and therefore must not contain confidential data. Cryptographic key type also matters. KMS supports symmetric encryption keys for common AWS-service encryption and asymmetric key types for operations such as RSA encryption/signing, elliptic-curve signing/key agreement, and other supported algorithms. KeyUsage determines whether a given asymmetric key is for encryption/decryption, signing/verification, MAC operations, or key agreement as applicable; it is not a general-purpose key that performs every operation.

Key takeaways

  1. 01

    Envelope encryption uses data keys for bulk data and a KMS key to protect those data keys.

  2. 02

    Every KMS key has a key policy; IAM permissions only work within the access model permitted by that policy.

  3. 03

    KMS grants can delegate selected key operations without rewriting the key policy for every temporary use.

  4. 04

    Encryption context is authenticated, policy-addressable metadata and must not contain secrets because it is logged.

  5. 05

    Key spec and KeyUsage determine which cryptographic operations and algorithms a KMS key supports.

Official AWS sources

Use these primary AWS resources for the source material behind this article and for deeper reference.