GenerateDataKeyApi is

called on KMS to get the

CMS key in the Plain
text and Encrypted
format

If the file to be 1. Client Request for

The technique is called
encrypted is more that CMS Key using the
Envelope Encyption
4KB then use this GenerateDataKey API
for encrypting a large
file
This is different from
Facts
the AWS S3 encryption
2. The KMS responds
back with 2
Both the Encryption and components, the CMS
Decryption happens on key in Plain Text and
the client side CMS key encrypted.

3. The File itself in

Encrypted using the
Flow Plain Text key
AWS Encryption SDK

4. The Encrypted Key in

aws-encryption-cli then bundled with
Comes with a CLI Encrypted CMS Data key
command
and completes the
Encryption. This bundle
is termed as Envelope
Encrytion

5. Decryption is
basically the reverse of
the above steps starting
with call the Encrypt
and Decrypt APIS