[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HM2CZ9Q4QCANJGETQNGTCA":3,"skill-same:01M6HM2CZ9Q4QCANJGETQNGTCA":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":6,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M6HM2CZ9Q4QCANJGETQNGTCA","implementing-envelope-encryption-with-aws-kms",null,"Envelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-envelope-encryption-with-aws-kms\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"KMS","implementing","with","implementing envelope encryption with aws kms","aws","encryption","cryptography","key-management","t1078","cybersecurity","envelope-encryption","data","strategy","management","master","data encryption","encrypted","pr","2026-11-10 10:12:30",false,"---\nname: implementing-envelope-encryption-with-aws-kms\ndescription: Envelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting\ndomain: cybersecurity\nsubdomain: cryptography\ntags:\n- cryptography\n- encryption\n- aws\n- kms\n- envelope-encryption\n- key-management\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.DS-01\n- PR.DS-02\n- PR.DS-10\nmitre_attack:\n- T1600\n- T1573\n- T1553\n- T1078.004\n- T1530\ncategory: implementing-envelope-encryption-with-aws-kms\n---\n# Implementing Envelope Encryption with AWS KMS\n\n## Overview\n\nEnvelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting large volumes of data locally while keeping the master key secure in a hardware security module (HSM) managed by AWS. This skill covers implementing envelope encryption using AWS KMS GenerateDataKey API.\n\n\n## When to Use\n\n- When deploying or configuring implementing envelope encryption with aws kms capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with cryptography concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Understand the envelope encryption pattern and its advantages\n- Generate data encryption keys using AWS KMS GenerateDataKey\n- Encrypt\u002Fdecrypt data locally using DEKs\n- Store encrypted DEK alongside ciphertext\n- Implement key caching to reduce KMS API calls\n- Handle key rotation with automatic re-encryption\n- Implement multi-region encryption for disaster recovery\n\n## Key Concepts\n\n### Envelope Encryption Flow\n\n1. Call `kms:GenerateDataKey` to get plaintext DEK + encrypted DEK\n2. Use plaintext DEK to encrypt data locally (AES-256-GCM)\n3. Store encrypted DEK alongside ciphertext\n4. Discard plaintext DEK from memory\n5. For decryption: call `kms:Decrypt` on encrypted DEK, then decrypt data\n\n### Advantages Over Direct KMS Encryption\n\n| Aspect | Direct KMS | Envelope Encryption |\n|--------|-----------|-------------------|\n| Max data size | 4 KB | Unlimited |\n| Latency | Network round-trip per operation | Local encryption |\n| Cost | $0.03\u002F10,000 requests | Fewer KMS requests |\n| Offline | Not possible | Yes (with cached DEKs) |\n\n### KMS Key Types\n\n- **AWS Managed**: AWS creates and manages (`aws\u002Fs3`, `aws\u002Febs`)\n- **Customer Managed**: You create and manage policies\n- **Custom Key Store**: Backed by CloudHSM cluster\n\n## Security Considerations\n\n- Never store plaintext DEK; only keep encrypted DEK\n- Use key policies to restrict who can call GenerateDataKey and Decrypt\n- Enable AWS CloudTrail logging for all KMS API calls\n- Implement key rotation (automatic annual rotation for CMKs)\n- Use encryption context for authenticated encryption metadata\n- Handle KMS throttling with exponential backoff\n\n## Validation Criteria\n\n- [ ] GenerateDataKey returns plaintext and encrypted DEK\n- [ ] Data encrypts correctly with plaintext DEK using AES-256-GCM\n- [ ] Encrypted DEK can be decrypted via KMS Decrypt API\n- [ ] Decrypted DEK recovers the original data\n- [ ] Plaintext DEK is wiped from memory after use\n- [ ] Encryption context is validated during decryption\n- [ ] Key rotation re-encrypts DEKs with new master key\n","# Implementing Envelope Encryption with AWS KMS\n\n## Overview\n\nEnvelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting large volumes of data locally while keeping the master key secure in a hardware security module (HSM) managed by AWS. This skill covers implementing envelope encryption using AWS KMS GenerateDataKey API.\n\n\n## When to Use\n\n- When deploying or configuring implementing envelope encryption with aws kms capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with cryptography concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Understand the envelope encryption pattern and its advantages\n- Generate data encryption keys using AWS KMS GenerateDataKey\n- Encrypt\u002Fdecrypt data locally using DEKs\n- Store encrypted DEK alongside ciphertext\n- Implement key caching to reduce KMS API calls\n- Handle key rotation with automatic re-encryption\n- Implement multi-region encryption for disaster recovery\n\n## Key Concepts\n\n### Envelope Encryption Flow\n\n1. Call `kms:GenerateDataKey` to get plaintext DEK + encrypted DEK\n2. Use plaintext DEK to encrypt data locally (AES-256-GCM)\n3. Store encrypted DEK alongside ciphertext\n4. Discard plaintext DEK from memory\n5. For decryption: call `kms:Decrypt` on encrypted DEK, then decrypt data\n\n### Advantages Over Direct KMS Encryption\n\n| Aspect | Direct KMS | Envelope Encryption |\n|--------|-----------|-------------------|\n| Max data size | 4 KB | Unlimited |\n| Latency | Network round-trip per operation | Local encryption |\n| Cost | $0.03\u002F10,000 requests | Fewer KMS requests |\n| Offline | Not possible | Yes (with cached DEKs) |\n\n### KMS Key Types\n\n- **AWS Managed**: AWS creates and manages (`aws\u002Fs3`, `aws\u002Febs`)\n- **Customer Managed**: You create and manage policies\n- **Custom Key Store**: Backed by CloudHSM cluster\n\n## Security Considerations\n\n- Never store plaintext DEK; only keep encrypted DEK\n- Use key policies to restrict who can call GenerateDataKey and Decrypt\n- Enable AWS CloudTrail logging for all KMS API calls\n- Implement key rotation (automatic annual rotation for CMKs)\n- Use encryption context for authenticated encryption metadata\n- Handle KMS throttling with exponential backoff\n\n## Validation Criteria\n\n- [ ] GenerateDataKey returns plaintext and encrypted DEK\n- [ ] Data encrypts correctly with plaintext DEK using AES-256-GCM\n- [ ] Encrypted DEK can be decrypted via KMS Decrypt API\n- [ ] Decrypted DEK recovers the original data\n- [ ] Plaintext DEK is wiped from memory after use\n- [ ] Encryption context is validated during decryption\n- [ ] Key rotation re-encrypts DEKs with new master key\n",{"name":5,"tags":42,"author":44,"domain":28,"license":15,"version":45,"category":5,"nist_csf":46,"subdomain":25,"description":7,"mitre_attack":50},[25,24,23,43,29,26],"kms","mahipal","1.0",[47,48,49],"PR.DS-01","PR.DS-02","PR.DS-10",[51,52,53,54,55],"T1600","T1573","T1553","T1078.004","T1530","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fimplementing-envelope-encryption-with-aws-kms",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill implementing-envelope-encryption-with-aws-kms",{"tool":70,"command":71},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill implementing-envelope-encryption-with-aws-kms",{"tool":73,"command":74},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill implementing-envelope-encryption-with-aws-kms","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-envelope-encryption-with-aws-kms\u002FSKILL.md",true,[78,84,89,95,99,103,109],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"assets\u002Ftemplate.md","ASSET","资产文件",2258,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-envelope-encryption-with-aws-kms\u002Fassets\u002Ftemplate.md",{"path":85,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-envelope-encryption-with-aws-kms\u002FLICENSE",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fapi-reference.md","REFERENCE","参考文档",1916,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-envelope-encryption-with-aws-kms\u002Freferences\u002Fapi-reference.md",{"path":96,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fstandards.md",1943,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-envelope-encryption-with-aws-kms\u002Freferences\u002Fstandards.md",{"path":100,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fworkflows.md",1515,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-envelope-encryption-with-aws-kms\u002Freferences\u002Fworkflows.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",6078,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-envelope-encryption-with-aws-kms\u002Fscripts\u002Fagent.py",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Fprocess.py",10876,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-envelope-encryption-with-aws-kms\u002Fscripts\u002Fprocess.py",[114,144,169,192,208,229],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":125,"publishedAt":37},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[120],{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[126,127,128,129,130,131,28,132,133,134,135,136,137,27,138,139,140,141,142,143],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":37},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[151,152,153,154,21,28,155,156,157,158,159,160,161,162,163,164,165,166,167,168],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":37},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[176,177,141,28,178,179,180,27,138,181,182,183,184,185,186,187,188,189,190,191],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":37},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[176,199,200,177,141,21,28,201,179,135,202,203,27,138,204,182,164,205,206,207],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":214,"publishedAt":37},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[176,215,216,217,218,219,28,220,221,222,179,223,27,224,225,226,185,227,141,228],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm","de",{"skillNo":230,"name":231,"nameZh":6,"description":232,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":233,"categories":234,"keywords":235,"publishedAt":37},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[236,237,238,239,28,240,241,242,243,244,245,224,246,247,227,248,228,249,250,251],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]