Lion Cipher Lab
Encrypt data with AWS KMS envelope encryption
- Cloud Security
- Advanced
- ~75 min
- Free · no account required
Why it matters
Almost every serious cloud system encrypts its data with a managed key service, and AWS KMS is the biggest. The pattern that makes it work at scale is envelope encryption: KMS only ever wraps a tiny 32-byte key, and your app uses that key to encrypt gigabytes locally. Get this wrong -- leave the plaintext data key in memory, skip the encryption context, or hand one identity both encrypt and decrypt -- and you have quietly undone the whole point of a key management service. Building it by hand once, against a free local emulator, is how you learn to read and fix a real KMS design.
What you'll learn
- Envelope encryption: what it is and why KMS never touches your bulk data
- Calling KMS GenerateDataKey and Decrypt from boto3
- Local AES-256-GCM encryption with a data key, then wiping the plaintext key
- Encryption context (AAD) as a cryptographic authorization binding
- Least-privilege KMS key policies (separating encrypt from decrypt)
- Automatic key rotation and why old ciphertexts still decrypt
- Running AWS APIs locally for free with LocalStack in Docker
Steps in this lab
- What envelope encryption is, in one breath
- Run AWS locally for free with LocalStack
- Point boto3 at LocalStack with dummy credentials
- Create your customer-managed key (CMK) and an alias
- Envelope-encrypt a file with GenerateDataKey
- Decrypt it back by unwrapping the data key
- Prove the encryption context is a real lock
- Lock the key down: least-privilege key policy
- Turn on rotation -- and see why old data still decrypts
- The judgment: hand-rolled vs the AWS Encryption SDK