About

Imported from mukul975/anthropic-cybersecurity-skills (skills/implementing-envelope-encryption-with-aws-kms/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill implementing-envelope-encryption-with-aws-kms. Copyright stays with the author (Apache-2.0).

Implementing Envelope Encryption with AWS KMS

Name: implementing-envelope-encryption-with-aws-kms
Author: mukul975

Overview

Envelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting large volumes of data locally while keeping the master key secure in a hardware security module (HSM) managed by AWS. This skill covers implementing envelope encryption using AWS KMS GenerateDataKey API.

When to Use

When deploying or configuring implementing envelope encryption with aws kms capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Understand the envelope encryption pattern and its advantages
Generate data encryption keys using AWS KMS GenerateDataKey
Encrypt/decrypt data locally using DEKs
Store encrypted DEK alongside ciphertext
Implement key caching to reduce KMS API calls
Handle key rotation with automatic re-encryption
Implement multi-region encryption for disaster recovery

Key Concepts

Envelope Encryption Flow

Call kms:GenerateDataKey to get plaintext DEK + encrypted DEK
Use plaintext DEK to encrypt data locally (AES-256-GCM)
Store encrypted DEK alongside ciphertext
Discard plaintext DEK from memory
For decryption: call kms:Decrypt on encrypted DEK, then decrypt data

Advantages Over Direct KMS Encryption

Aspect	Direct KMS	Envelope Encryption
Max data size	4 KB	Unlimited
Latency	Network round-trip per operation	Local encryption
Cost	$0.03/10,000 requests	Fewer KMS requests
Offline	Not possible	Yes (with cached DEKs)

KMS Key Types

AWS Managed: AWS creates and manages (aws/s3, aws/ebs)
Customer Managed: You create and manage policies
Custom Key Store: Backed by CloudHSM cluster

Security Considerations

Never store plaintext DEK; only keep encrypted DEK
Use key policies to restrict who can call GenerateDataKey and Decrypt
Enable AWS CloudTrail logging for all KMS API calls
Implement key rotation (automatic annual rotation for CMKs)
Use encryption context for authenticated encryption metadata
Handle KMS throttling with exponential backoff

Validation Criteria

GenerateDataKey returns plaintext and encrypted DEK
Data encrypts correctly with plaintext DEK using AES-256-GCM
Encrypted DEK can be decrypted via KMS Decrypt API
Decrypted DEK recovers the original data
Plaintext DEK is wiped from memory after use
Encryption context is validated during decryption
Key rotation re-encrypts DEKs with new master key

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-env-e30fd2/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-implementing-env-e30fd2.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-implementing-env-e30fd2",
  "kind": "skill",
  "name": "implementing-envelope-encryption-with-aws-kms",
  "description": "Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "cryptography",
      "encryption",
      "aws",
      "kms",
      "envelope-encryption",
      "key-management",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/implementing-envelope-encryption-with-aws-kms/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/implementing-envelope-encryption-with-aws-kms/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/implementing-envelope-encryption-with-aws-kms/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Implementing Envelope Encryption with AWS KMS\n\n## Overview\n\nEnvelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting large volumes of data locally while keeping the master key secure in a hardware security module (HSM) managed by AWS. This skill covers implementing envelope encryption using AWS KMS GenerateDataKey API.\n\n\n## When to Use\n\n- When deploying or configuring implementing envelope encryption with aws kms capabilities in your environment\n- Whe",
  "cost": {
    "context_tokens": 771
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-env-e30fd2/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.