A municipal batch job encrypts multi-gigabyte evidence files with K…

Question

A municipal batch job encrypts multi-gigabyte evidence files with KMS. Why should it use data keys (envelope encryption) instead of sending entire payloads to the KMS Encrypt API?

Accepted Answer

Generate a data key, encrypt the large file locally with that key, and protect the data key with the CMK. — KMS is a key vault, not a dump truck for multi-gigabyte blobs. Generate a data key, encrypt the big file yourself, and wrap that data key with the CMK—classic envelope encryption. Shipping the whole evidence file through Encrypt is the wrong tool.

Answer

KMS Encrypt has no size limits, so envelope encryption is only for DynamoDB.

Answer

Upload plaintext to S3 and ask CloudWatch to encrypt the object later.

Answer

Base64-encode the file and store it in Parameter Store instead of using encryption.

A municipal batch job encrypts multi-gigabyte evidence files with KMS. Why should it use data keys (envelope encryption) instead of sending entire payloads to the KMS Encrypt API?

Short Explanation

Full Explanation