Envelope encryption

Envelope encryption is the practice of encrypting plaintext data with a Data Encryption Key (DEK), and then encrypting the DEK with a Key Encryption Key (KEK).

This method combines the speed of symmetric encryption for large data with the security of a central Key Management Service (KMS) for managing the KEK. The encrypted DEK is stored alongside the encrypted data.