Customer Master Key (CMK) created

in KMS and mapped to S3

Encryption Steps:

Data sent to S3

S3 receives data keys from KMS

S3 encrypts data

Stores encrypted data & data key

Decryption Steps:

S3 sends encrypted data key to KMS

KMS decrypts using CMK. Returns data key.

S3 uses plain text data key to decrypt data

Remove data key from memory asap

Also called Envelope Encryption