> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/envelope-encryption.md).

# Envelope Encryption

* Envelope encryption is the practice of **encrypting plaintext data with a data key, and then encrypting the data key under another key**.

* You can even **encrypt the data encryption key under another encryption key, and encrypt that encryption key under another encryption key, etc.**
  * But, **eventually, one key must remain in plaintext so you can decrypt the keys and your data**.
  * This **top-level plaintext key encryption key is known as the master key**.

![](https://560082743-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MT1aTjM0U73ienXQ-F0%2F-MTTewffR_0QN2bp6cx5%2F-MTW2ekLkVvBNwDv829I%2Fimage.png?alt=media\&token=8e648d12-8c9f-4705-bdeb-f3b4d2cd428e)

* **KMS helps you to protect your master keys** by storing and managing them securely.
* Master keys stored in KMS, known as **CMKs, never leave the AWS KMS FIPS validated hardware security modules unencrypted**.
* To **use a KMS CMK, you must call KMS**.

![](https://560082743-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MT1aTjM0U73ienXQ-F0%2F-MTTewffR_0QN2bp6cx5%2F-MTW2h9-hueH7xToHjjF%2Fimage.png?alt=media\&token=bda531f5-69f7-4fef-b9e7-87fa6a099142)