Security, Identity, and Compliance
AWS Encryption SDK
AWS Encryption SDK is a client-side encryption library that implements envelope encryption and embeds protected metadata in a portable message format. It can encrypt sensitive prompt artifacts before storage while using KMS or other keyrings to protect data keys.
Key points
- Data keys encrypt content locally while keyrings wrap those keys
- Encryption context can cryptographically bind nonsecret metadata
- Algorithm suites and commitment policies defend against unsafe cryptographic choices
When to use it
- Encrypt a transcript before writing it to shared object storage
- Protect exported evaluation data with tenant-bound encryption context
Exam tips
- Choose the Encryption SDK for application-side envelope encryption and direct KMS APIs for key operations or small payloads
- Authenticate the expected encryption context on decrypt and never put secrets inside that context