Record · corpus.blog/posts/01a08783-2996-72ba-a876-ac53e94510a6

AWS KMS Envelope Encryption and Data Key Caching Patterns - Design Decisions for the AWS Encryption SDK and Multi-Region Keys | hidekazu-konishi.com

hidekazu-konishi.com · published 2 August 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at hidekazu-konishi.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
External links: 35
Words captured: 14,770

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/developerguide/requests-per-second.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/developerguide/mrk-how-it-works.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/developerguide/monitoring-keys-determining-usage.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/cryptographic-details/crypto-primitives.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/cryptographic-details/rotate-customer-master-key.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/cryptographic-details/key-deletion.html

docs.aws.amazon.com

https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html

docs.aws.amazon.com

https://docs.aws.amazon.com/cli/latest/reference/kms/encrypt.html

docs.aws.amazon.com

https://docs.aws.amazon.com/prescriptive-guidance/latest/aws-kms-best-practices/access.html

docs.aws.amazon.com

https://docs.aws.amazon.com/prescriptive-guidance/latest/aws-kms-best-practices/data-protection-key-rotation.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/choose-keyring.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/use-hierarchical-keyring.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/create-keystore.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/data-key-caching.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/implement-caching.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/data-caching-details.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/thresholds.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/algorithms-reference.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/migrate-commitment-policy.html

docs.aws.amazon.com

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html

docs.aws.amazon.com

https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/dynamodb-encryption-client.html

docs.aws.amazon.com

https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html

docs.aws.amazon.com

https://aws.amazon.com/security/security-bulletins/rss/2026-017-aws/

aws.amazon.com

https://aws.amazon.com/about-aws/whats-new/2026/04/aws-kms-tracks-last-usage-kms-keys/

aws.amazon.com

https://aws.amazon.com/blogs/security/aws-encryption-sdk-how-to-decide-if-data-key-caching-is-right-for-your-application/

aws.amazon.com

https://aws.amazon.com/blogs/security/encrypt-global-data-client-side-with-aws-kms-multi-region-keys/

aws.amazon.com

https://aws.amazon.com/blogs/security/identify-unused-aws-kms-keys-and-prevent-accidental-key-deletions/

aws.amazon.com

https://aws.amazon.com/kms/faqs/

aws.amazon.com

Elsewhere on hidekazu-konishi.com (13)

AWS History and Timeline regarding AWS Key Management Service - Overview, Functions, Features, Summary of Updates, and Introduction to KMS | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

IAM Policy Evaluation Logic Step-by-Step - Explicit Deny, RCP, SCP, Resource Policy, Identity Policy, Permission Boundary, and Session Policy | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

Amazon S3 Security and Access Control Guide - Bucket Policies, IAM, Access Points, Block Public Access, and Encryption | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

Cryptography Glossary for Engineers - AES, RSA, ECDSA, HKDF, Envelope Encryption, and TLS Explained | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

AWS Secrets Manager and Parameter Store Decision Guide - Storing, Rotating, and Accessing Secrets and Configuration | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

Amazon DynamoDB Master Index - A Hub for DynamoDB Design, Key Modeling, and Capacity Planning Articles | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

AWS Multi-Region Active-Active Architecture Guide - Global Data Replication, Routing, and Failover with Route 53, DynamoDB Global Tables, and Aurora Global Database | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

AWS Organization Guardrails - Service Control Policies, Resource Control Policies, and Data Perimeter Design | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

AWS KMS Key Policy Builder Tool - Visual Builder and Linter for AWS KMS Key Policies | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

Resource-Based Policies by Service on AWS - Where the Second Policy Lives, What It Can Say, and When It Is Required | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

Centralized Logging and Audit Architecture on AWS - Multi-Account Log Aggregation, Detection, and Query with CloudTrail, Config, Security Hub, and OpenSearch | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

Post-Quantum Cryptography Standardization Timeline and Migration on AWS - From Algorithm Selection to Service Support | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

Fine-Grained Access Control for AI Data with AWS Lake Formation - LF-Tags, Column-Level Permissions, and Cross-Account Sharing | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com