Key management and secrets
Envelope encryption with a KMS, rotation that rewraps keys instead of data, the key lifecycle from NIST SP 800-57, and how to keep secrets out of code.
25 min6 steps
By the end you can
- Design envelope encryption with data keys and a key-encryption key, and estimate its KMS load
- Plan a key rotation that rewraps data keys instead of re-encrypting data
- Apply key lifecycle rules (single purpose, cryptoperiods, compromise response) to an incident
- Keep secrets out of code and images, and respond correctly when one leaks
Envelope encryption
Sending all data through a KMS does not scale (calls cap payload; AWS KMS takes 4 KB). Envelope encryption: encrypt data with a local DEK, wrap the DEK under a KEK that never leaves the KMS, store the wrapped DEK beside the ciphertext. Caching a DEK cuts KMS load but widens the blast radius.
Loading question…
Why the hierarchy helps
The KEK is the one secret that matters. Data access becomes an audited, revocable unwrap permission.
Rotation rewraps keys, not data
Rotating a KEK makes a new version. Unwrap each DEK with the old version, rewrap with the new. Bulk data never moves: the job scales with the number of DEKs.
Rewrap DEKs
- Small keys only
- Scales with key count
Re-encrypt data
- Terabytes move
- Needed only if a DEK leaks
Loading question…
The key lifecycle
NIST SP 800-57: every key is generated, activated, used for a cryptoperiod, deactivated, destroyed. One purpose per key. Plan compromise recovery in advance.
1
Generate
2
Activate and use (cryptoperiod)
3
Deactivate: decrypt/verify only
4
Destroy
Secrets are keys too
Passwords, API keys and signing keys follow the same lifecycle. Never commit or bake them in. Fetch from a secrets manager, prefer short-lived credentials, rotate routinely.
Static secret in repo or image
- Leaks forever
- Rotation is an emergency
Runtime fetch, short-lived
- Per-workload access
- Audit log
- Auto-expires
A production database password was pushed to a public repository an hour ago. Order the response.
- 1Remove the secret from the repository history and any forks or caches you control
- 2Rotate the password immediately and deploy the new one from the secrets manager
- 3Check database and network audit logs for use of the old credential since the push
- 4Add secret scanning to pre-commit hooks and CI, and move the service to short-lived credentials
Check your mastery
Score 80% or more.
Mastery check
4 questions on fresh variants. One attempt each, no time limit. Score 80% or more to master the lesson.
Next: privacy and data deletion, where per-user keys make deletion possible.
Answer this step to continue.