Envelope Encryption

Envelope encryption is a two-layer key scheme: you encrypt your data with a fast, per-object data encryption key (DEK), then encrypt that DEK with a separate, well-guarded key encryption key (KEK) held in a key management service (KMS). The encrypted DEK is stored right next to the ciphertext, like a sealed envelope, while the KEK never leaves the KMS. This solves two problems at once — bulk data encryption stays fast because DEKs are symmetric and local, and key rotation becomes cheap because rotating the KEK only re-encrypts the small DEKs, not terabytes of data. It's the pattern underneath most cloud encryption-at-rest and a clean way to implement bring-your-own-key. Practical note: let your KMS generate and wrap DEKs, cache decrypted DEKs briefly in memory to avoid a KMS call per request, scope KEKs per tenant when customers demand isolation, and log every KEK use so you have an audit trail of who decrypted what.