Cloud Architecture

AWS Envelope Encryption with KMS & Secrets Manager

Cloud Architecture diagram · made in Skemio

Architecture flow diagram showing KMS generating a plaintext and encrypted Data Key for an App Service, which encrypts data before storing it in S3.
Architecture flow diagram showing KMS generating a plaintext and encrypted Data Key for an App Service, which encrypts data before storing it in S3.
Open it in SkemioMake your own

What it shows

  • KMS generates a plaintext Data Encryption Key (DEK) and an encrypted DEK.
  • Your service encrypts raw data locally with plaintext DEK, then deletes it.
  • Only the encrypted DEK and ciphertext are stored, shielding root master keys.

The takeaway

Envelope encryption decouples key management from data size, combining performance with central governance.

More cloud architecture diagrams