Envelope Encrypt and Decrypt
A 3-step recipe with Amazon KMS. We can help you get access.
Recipe · 3 steps
Envelope Encrypt and Decrypt
with Amazon KMS · Cybersecurity Management
Generate a data key, encrypt plaintext, then decrypt the ciphertext.
- Generate a unique symmetric data key under the KMS key for client-side encryption, returning both the plaintext and encrypted forms.
- Encrypt the supplied plaintext payload directly with the KMS key and capture the resulting ciphertext blob.
- Decrypt the ciphertext produced by the encrypt step to verify the round trip returns the original plaintext.
What you'll need to have ready
- KeyId: Identifies the KMS key used for the cryptographic operations.
- Plaintext: Base64-encoded plaintext (up to 4,096 bytes) to encrypt.
- KeySpec: The length of the data key to generate (e.g. AES_256).
For your developer
Arazzo workflow amazon-kms:envelope-encrypt-decrypt, 3 operations: GenerateDataKey → Encrypt → Decrypt. Specs on APIs.io.