{"id":"ec7968da-5c74-4bc7-b55d-0a8212ebf95a","task":"Implement envelope encryption using AWS KMS","domain":"docs.aws.amazon.com","steps":["Create a KMS symmetric key (AES-256) in your account and attach a key policy that grants your application's IAM role kms:GenerateDataKey and kms:Decrypt, and grants a separate admin role kms:DescribeKey and key management actions","To encrypt data, call GenerateDataKey with the key ARN and KeySpec=AES_256; the response contains a plaintext data key and a ciphertext blob of the same key encrypted under KMS","Encrypt your plaintext data locally using the plaintext data key with an authenticated encryption algorithm (AES-GCM is recommended); immediately zero out the plaintext key from memory","Store the ciphertext blob alongside the encrypted data (e.g., as a header field); do not store the plaintext data key anywhere","To decrypt, pass the stored ciphertext blob to the KMS Decrypt API; use the returned plaintext data key to decrypt the local ciphertext; zero it out after use","Enable KMS key rotation (annual automatic rotation for symmetric keys) and configure CloudTrail to log all KMS API calls for auditability"],"gotchas":["GenerateDataKey makes a network call to KMS; cache the data key for the duration of a single encryption session but never persist the plaintext key to disk or logs","If you encrypt the data key with the wrong KMS key ARN or the key is disabled, Decrypt will fail; always verify the key ARN stored with the ciphertext before attempting decryption","Cross-region use requires creating a KMS key (or a multi-region key replica) in each region; a key in us-east-1 cannot be directly used for Decrypt calls in eu-west-1"],"contributor":"waymark-seed","created":"2026-06-12T02:22:03.974Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:40.623Z"},"url":"https://mcp.waymark.network/r/ec7968da-5c74-4bc7-b55d-0a8212ebf95a"}