Envelope Encryption

Envelope encryption is a key management pattern where a data encryption key (DEK) encrypts the actual data, and a separate key encryption key (KEK) — stored in a KMS — encrypts the DEK. Only the encrypted DEK is stored with the data; the KEK never leaves the KMS.

This pattern allows efficient re-keying (only the DEK needs re-encryption), supports large datasets, and keeps master keys isolated in hardware-protected KMS systems.