What it does. Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-envelope-encryption-with-aws-kms/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-envelope-encryption-with-aws-kms, or copy the skill folder into ~/.claude/skills/implementing-envelope-encryption-with-aws-kms/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-envelope-encryption-with-aws-kms/SKILL.md

SKILL.md (verbatim)

name: implementing-envelope-encryption-with-aws-kms
description: Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume.
domain: cybersecurity
subdomain: cryptography
tags:
- cryptography
- encryption
- aws
- kms
- envelope-encryption
- key-management
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.DS-01
- PR.DS-02
- PR.DS-10
mitre_attack:
- T1600
- T1573
- T1553
- T1078.004
- T1530

Implementing Envelope Encryption with AWS KMS

Overview

Envelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting large volumes of data locally while keeping the master key secure in a hardware security module (HSM) managed by AWS. This skill covers implementing envelope encryption using AWS KMS GenerateDataKey API.

When to Use

• When deploying or configuring implementing envelope encryption with aws kms capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with cryptography concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Understand the envelope encryption pattern and its advantages
• Generate data encryption keys using AWS KMS GenerateDataKey
• Encrypt/decrypt data locally using DEKs
• Store encrypted DEK alongside ciphertext
• Implement key caching to reduce KMS API calls
• Handle key rotation with automatic re-encryption
• Implement multi-region encryption for disaster recovery

Key Concepts

Envelope Encryption Flow

1. Call kms:GenerateDataKey to get plaintext DEK + encrypted DEK
2. Use plaintext DEK to encrypt data locally (AES-256-GCM)
3. Store encrypted DEK alongside ciphertext
4. Discard plaintext DEK from memory
5. For decryption: call kms:Decrypt on encrypted DEK, then decrypt data

Advantages Over Direct KMS Encryption

Aspect	Direct KMS	Envelope Encryption
Max data size	4 KB	Unlimited
Latency	Network round-trip per operation	Local encryption
Cost	$0.03/10,000 requests	Fewer KMS requests
Offline	Not possible	Yes (with cached DEKs)

KMS Key Types

• AWS Managed: AWS creates and manages (aws/s3, aws/ebs)
• Customer Managed: You create and manage policies
• Custom Key Store: Backed by CloudHSM cluster

Security Considerations

• Never store plaintext DEK; only keep encrypted DEK
• Use key policies to restrict who can call GenerateDataKey and Decrypt
• Enable AWS CloudTrail logging for all KMS API calls
• Implement key rotation (automatic annual rotation for CMKs)
• Use encryption context for authenticated encryption metadata
• Handle KMS throttling with exponential backoff

Validation Criteria

• GenerateDataKey returns plaintext and encrypted DEK
• Data encrypts correctly with plaintext DEK using AES-256-GCM
• Encrypted DEK can be decrypted via KMS Decrypt API
• Decrypted DEK recovers the original data
• Plaintext DEK is wiped from memory after use
• Encryption context is validated during decryption
• Key rotation re-encrypts DEKs with new master key

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Envelope Encryption with AWS KMS Template

Prerequisites Checklist

• AWS account with KMS access
• IAM policy allows kms:GenerateDataKey, kms:Decrypt, kms:ReEncrypt
• KMS Customer Managed Key (CMK) created
• CloudTrail logging enabled for KMS events
• boto3 and cryptography Python libraries installed

IAM Policy Template

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:DescribeKey"
      ],
      "Resource": "arn:aws:kms:us-east-1:123456789012:key/your-key-id"
    }
  ]
}

KMS Key Policy Template

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowKeyAdministration",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:role/KeyAdmin"},
      "Action": [
        "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*",
        "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*",
        "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion",
        "kms:CancelKeyDeletion"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowKeyUsage",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:role/AppRole"},
      "Action": ["kms:Decrypt", "kms:GenerateDataKey", "kms:ReEncrypt*"],
      "Resource": "*"
    }
  ]
}

Quick Reference

import boto3
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os

kms = boto3.client('kms')

# Encrypt
resp = kms.generate_data_key(KeyId='alias/my-key', KeySpec='AES_256')
plaintext_key = resp['Plaintext']
encrypted_key = resp['CiphertextBlob']

nonce = os.urandom(12)
ciphertext = AESGCM(plaintext_key).encrypt(nonce, data, None)
# Store: encrypted_key + nonce + ciphertext

# Decrypt
resp = kms.decrypt(CiphertextBlob=encrypted_key)
plaintext_key = resp['Plaintext']
data = AESGCM(plaintext_key).decrypt(nonce, ciphertext, None)

Cost Estimation

Operation	Price	Notes
KMS API requests	$0.03 per 10,000	GenerateDataKey, Decrypt
CMK storage	$1.00 per month	Per customer managed key
Key rotation	Free	Automatic annual rotation

references/api-reference.md (verbatim)

API Reference — Implementing Envelope Encryption with AWS KMS

Libraries Used

• boto3: AWS SDK for KMS key management and data key generation
• cryptography: AES-256-GCM for local data encryption with generated data keys

CLI Interface

python agent.py --region us-east-1 encrypt --input <file> --output <out> --key-id <kms_key>
python agent.py --region us-east-1 decrypt --input <encrypted> --output <out>
python agent.py --region us-east-1 list-keys
python agent.py --region us-east-1 audit --key-id <kms_key>

Core Functions

generate_data_key(kms_key_id, region)

Generates a data encryption key (DEK) using AWS KMS.

• kms.generate_data_key(KeyId=key_id, KeySpec="AES_256")
• Returns plaintext key (for local encryption) and encrypted key (for storage).

encrypt_data(plaintext_bytes, kms_key_id, region)

Performs envelope encryption: generates DEK via KMS, encrypts data locally with AES-256-GCM, stores encrypted DEK alongside ciphertext.

decrypt_data(envelope, region)

Decrypts envelope: calls kms.decrypt(CiphertextBlob=encrypted_key) to recover DEK, then decrypts data locally.

list_kms_keys(region)

Lists KMS keys with metadata using kms.list_keys() and kms.describe_key().

audit_key_policy(key_id, region)

Audits KMS key policy for overly permissive principals (Principal: "*").

• kms.get_key_policy(KeyId=key_id, PolicyName="default")

boto3 KMS API Calls

Method	Purpose
kms.generate_data_key(KeyId, KeySpec)	Generate plaintext + encrypted DEK
kms.decrypt(CiphertextBlob)	Decrypt encrypted DEK back to plaintext
kms.list_keys()	List all KMS keys in the account
kms.describe_key(KeyId)	Get key metadata (state, usage, origin)
kms.get_key_policy(KeyId, PolicyName)	Get key resource policy JSON

Dependencies

pip install boto3>=1.28 cryptography>=41.0

references/standards.md (verbatim)

Standards and References - Envelope Encryption with AWS KMS

AWS Documentation

AWS KMS Developer Guide

• URL: https://docs.aws.amazon.com/kms/latest/developerguide/
• Envelope Encryption: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#enveloping

AWS KMS API Reference

• GenerateDataKey: https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html
• Decrypt: https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html
• ReEncrypt: https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html

AWS Encryption SDK

• URL: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/
• Python: https://aws-encryption-sdk-python.readthedocs.io/

Cryptographic Standards

NIST SP 800-57 Part 1 - Key Management

• URL: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
• Relevance: Key hierarchy and key wrapping concepts

NIST SP 800-38F - Key Wrap

• URL: https://csrc.nist.gov/publications/detail/sp/800-38f/final
• Description: AES Key Wrap specification used by KMS internally

FIPS 140-2 Level 2 (KMS HSMs)

• Description: KMS HSMs are validated at FIPS 140-2 Level 2 (Level 3 for CloudHSM)

Compliance Frameworks

PCI DSS v4.0 Requirement 3

• Key management with separation of DEK and KEK
• KMS satisfies key management requirements

SOC 2 Type II

• AWS KMS is SOC 2 compliant
• Encryption controls map to CC6.1 (logical access controls)

HIPAA

• KMS encryption satisfies encryption requirements for ePHI
• BAA required with AWS

Python Libraries

boto3 (AWS SDK for Python)

• URL: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/kms.html
• PyPI: https://pypi.org/project/boto3/

aws-encryption-sdk

• URL: https://pypi.org/project/aws-encryption-sdk/
• Description: High-level envelope encryption with caching

references/workflows.md (verbatim)

Workflows - Envelope Encryption with AWS KMS

Workflow 1: Encrypt Data with Envelope Encryption

[Application]
      |
[Call KMS GenerateDataKey]
(KeyId=CMK ARN, KeySpec=AES_256)
      |
[KMS Returns]:
  - Plaintext DEK (32 bytes)
  - Encrypted DEK (ciphertext blob)
      |
[Encrypt Data Locally]
(AES-256-GCM with plaintext DEK)
      |
[Store]:
  - Encrypted DEK (ciphertext blob)
  - Encrypted data (nonce + ciphertext + tag)
  - Encryption context metadata
      |
[Wipe Plaintext DEK from Memory]

Workflow 2: Decrypt Data

[Read Stored Data]
  - Encrypted DEK
  - Encrypted data
  - Encryption context
      |
[Call KMS Decrypt]
(CiphertextBlob=Encrypted DEK, EncryptionContext)
      |
[KMS Returns Plaintext DEK]
      |
[Decrypt Data Locally]
(AES-256-GCM with plaintext DEK)
      |
[Return Plaintext Data]
      |
[Wipe Plaintext DEK from Memory]

Workflow 3: Key Rotation

[Enable Automatic Key Rotation on CMK]
(KMS rotates backing key annually)
      |
[New GenerateDataKey calls use new backing key]
      |
[Old encrypted DEKs still decrypt]
(KMS tracks all backing key versions)
      |
[Optional: Re-encrypt old DEKs]
[Call KMS ReEncrypt to update DEK encryption]

Workflow 4: Multi-Region Encryption

[Primary Region (us-east-1)]
  |
  [Create Multi-Region CMK]
  [Replicate to us-west-2, eu-west-1]
  |
  [Encrypt with Regional Endpoint]
  |
[Secondary Region (us-west-2)]
  |
  [Same Key ID works for Decrypt]
  [No cross-region API calls needed]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.