Generate a data encryption key with AWS KMS GenerateDataKey for envelope encryption

Steps

1. Create or identify a KMS symmetric key (key type SYMMETRIC_DEFAULT) and note its key ID or ARN
2. Call GenerateDataKey with the key ID and desired KeySpec (e.g., AES_256), optionally supplying an EncryptionContext map for additional authenticated data
3. Receive the plaintext DEK and the ciphertext blob; use the plaintext DEK in memory to encrypt your payload with a library such as AES-GCM, then discard the plaintext DEK
4. Store the ciphertext blob alongside the encrypted payload so the KEK identity is recorded but the plaintext key is never persisted
5. To decrypt, call KMS Decrypt with the stored ciphertext blob and the same EncryptionContext, receive the plaintext DEK, decrypt the payload, then discard the DEK again
6. Rotate the KMS key on a schedule (consult current docs for automatic rotation options) and rewrap stored ciphertext blobs as needed