Comparison
Envelope encryptionvsKey management service
Envelope encryption
the data is encrypted with a key that is itself encrypted by a key you never see, and rotating the outer one does not rewrite the data.
Encrypting data with a locally-generated data key, then encrypting that key with a master key held in a key management service. It keeps bulk encryption fast and local while centralising control, and it makes master key rotation cheap because only the small wrapped keys need re-encrypting. It is the standard construction under nearly every managed at-rest encryption feature, which is worth knowing because the master key's access policy is then the real control.
Full entry →Key management service
the key never leaves the service; you send it data to encrypt and it sends the result back, logging every call.
A managed service that holds cryptographic keys and performs operations with them, so the key material is never exposed to callers. Its access policy becomes the actual boundary on the data it protects, which means deleting or losing access to a key is equivalent to deleting the data. Scheduled key deletion has a waiting period for exactly that reason, and it is one of the few genuinely irreversible cloud operations.
Full entry →