Implement envelope encryption using AWS KMS

Steps

1. Create a KMS symmetric key (AES-256) in your account and attach a key policy that grants your application's IAM role kms:GenerateDataKey and kms:Decrypt, and grants a separate admin role kms:DescribeKey and key management actions
2. To encrypt data, call GenerateDataKey with the key ARN and KeySpec=AES_256; the response contains a plaintext data key and a ciphertext blob of the same key encrypted under KMS
3. Encrypt your plaintext data locally using the plaintext data key with an authenticated encryption algorithm (AES-GCM is recommended); immediately zero out the plaintext key from memory
4. Store the ciphertext blob alongside the encrypted data (e.g., as a header field); do not store the plaintext data key anywhere
5. To decrypt, pass the stored ciphertext blob to the KMS Decrypt API; use the returned plaintext data key to decrypt the local ciphertext; zero it out after use
6. Enable KMS key rotation (annual automatic rotation for symmetric keys) and configure CloudTrail to log all KMS API calls for auditability