Implement client-side envelope encryption with the AWS Encryption SDK using a multi-keyring across regions and discovery-mode decryption for disaster recovery
domain: docs.aws.amazon.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Configure a KMS keyring per region — a generator keyring for the primary region and additional child keyrings for other regions — and combine them into a single multi-keyring.
Encrypt data with the multi-keyring so the resulting message header carries a copy of the data key wrapped by every configured region's KMS key, without needing to re-encrypt per region.
For decryption in a failover scenario where the exact key ARN used at encrypt time isn't known ahead of time, use a discovery keyring (decrypt-only, supported in the Python and Java SDKs from version 1.7.x onward, and in C/JavaScript) scoped with account and partition restrictions.
Never configure a discovery keyring for encryption — it has no key material and encrypt operations using it fail (behavior varies slightly by language SDK).
Scope the discovery keyring's implicit trust narrowly (specific AWS account IDs and partition) rather than leaving it unrestricted, so it will only attempt decryption with keys from accounts you trust.
Known gotchas
An unscoped discovery keyring will attempt decryption using any KMS key that encrypted the message, including keys from untrusted or unexpected AWS accounts if the message was crafted maliciously.
Multi-keyring encryption increases ciphertext header size proportional to the number of wrapping keys, since a data key copy is stored per keyring.
Discovery-mode support differs by SDK language and version — confirm your specific SDK and version actually supports it before depending on it for a DR runbook.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?