Envelope Encryption with AWS KMS
FreeSecurely encrypt data using AWS KMS with envelope encryption.
Free · Opens the source repo
What Envelope Encryption with AWS KMS does
This skill implements envelope encryption using AWS Key Management Service (KMS), a method that enhances data security by encrypting data with a locally generated data encryption key (DEK) and then protecting that DEK with a KMS-managed key (KEK). This approach allows for efficient encryption of large data volumes while ensuring that the master key remains secure within AWS's hardware security module (HSM). By utilizing the AWS KMS GenerateDataKey API, users can generate DEKs that are used for local encryption, significantly reducing the need for direct KMS API calls and enhancing performance.
The implementation process includes generating a DEK, using it to encrypt data locally with AES-256-GCM, and securely storing the encrypted DEK alongside the ciphertext. This skill also covers essential security practices such as key caching to minimize KMS requests, handling key rotation, and conducting multi-region encryption for disaster recovery scenarios. With a focus on security validation, the skill outlines the necessary criteria to ensure that the encryption and decryption processes are executed correctly.
This skill is particularly useful for developers and security architects who are tasked with designing key management solutions for encrypting large or numerous data objects on AWS. It is also beneficial for those looking to comply with security standards and regulations, as it provides a robust framework for implementing encryption controls. By leveraging this skill, users can enhance their security architecture and streamline their encryption workflows, ensuring data integrity and confidentiality.
When to use it
Use this skill when you need to implement envelope encryption for large datasets on AWS or when you want to optimize your KMS API usage.
When not to use it
This skill may not be suitable for small-scale encryption needs or scenarios where direct KMS encryption is preferred due to its simplicity.
What you can build with it
Large Data Encryption
Use this skill to encrypt large datasets efficiently by leveraging envelope encryption, minimizing direct KMS calls.
Compliance Implementation
Implement this skill to align your data encryption practices with compliance requirements, ensuring data security.
Security Architecture Improvement
Enhance your security architecture by integrating this skill into your key management strategies for robust data protection.
How to install Envelope Encryption with AWS KMS
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/implementing-envelope-encryption-with-aws-kms --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Implementing Envelope Encryption with AWS KMS
Overview
Envelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting large volumes of data locally while keeping the master key secure in a hardware security module (HSM) managed by AWS. This skill covers implementing envelope encryption using AWS KMS GenerateDataKey API.
When to Use
- When deploying or configuring implementing envelope encryption with aws kms capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Familiarity with cryptography concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Understand the envelope encryption pattern and its advantages
- Generate data encryption keys using AWS KMS GenerateDataKey
- Encrypt/decrypt data locally using DEKs
- Store encrypted DEK alongside ciphertext
- Implement key caching to reduce KMS API calls
- Handle key rotation with automatic re-encryption
- Implement multi-region encryption for disaster recovery
Key Concepts
Envelope Encryption Flow
- Call
kms:GenerateDataKeyto get plaintext DEK + encrypted DEK - Use plaintext DEK to encrypt data locally (AES-256-GCM)
- Store encrypted DEK alongside ciphertext
- Discard plaintext DEK from memory
- For decryption: call
kms:Decrypton encrypted DEK, then decrypt data
Advantages Over Direct KMS Encryption
| Aspect | Direct KMS | Envelope Encryption |
|---|---|---|
| Max data size | 4 KB | Unlimited |
| Latency | Network round-trip per operation | Local encryption |
| Cost | $0.03/10,000 requests | Fewer KMS requests |
| Offline | Not possible | Yes (with cached DEKs) |
KMS Key Types
- AWS Managed: AWS creates and manages (
aws/s3,aws/ebs) - Customer Managed: You create and manage policies
- Custom Key Store: Backed by CloudHSM cluster
Security Considerations
- Never store plaintext DEK; only keep encrypted DEK
- Use key policies to restrict who can call GenerateDataKey and Decrypt
- Enable AWS CloudTrail logging for all KMS API calls
- Implement key rotation (automatic annual rotation for CMKs)
- Use encryption context for authenticated encryption metadata
- Handle KMS throttling with exponential backoff
Validation Criteria
- GenerateDataKey returns plaintext and encrypted DEK
- Data encrypts correctly with plaintext DEK using AES-256-GCM
- Encrypted DEK can be decrypted via KMS Decrypt API
- Decrypted DEK recovers the original data
- Plaintext DEK is wiped from memory after use
- Encryption context is validated during decryption
- Key rotation re-encrypts DEKs with new master key
Frequently asked questions about Envelope Encryption with AWS KMS
Similar skills
Secret Scanning
Protect your code by preventing secret leaks.
MCP Security Audit
Ensure your MCP configurations are secure and compliant.
iMessage Access Management
Control access to your iMessage channel securely.
Implementing Secret Scanning with Gitleaks
Automate detection of hardcoded secrets in git repositories.
Secrets Vault Manager
Manage and secure your secret infrastructure efficiently.
AWS Secrets Manager
Safely manage secrets without exposing plaintext values.