An application encrypts large volumes of data. KMS has a 4 KB limit per Encrypt call. How does KMS handle encryption of larger data?
A.KMS automatically splits data into 4 KB chunks
KMS doesn't accept data over the 4 KB limit — it never sees the bulk data.
B.Envelope encryption — KMS generates a data key that encrypts the data locally, and encrypts only that key
Correct. Only the data key goes through KMS; bulk encryption happens locally.
C.Stream the data through KMS in batches
There's no streaming Encrypt API — KMS only encrypts the small data key.
D.Upload data to KMS-managed S3 storage
KMS doesn't store customer data; it manages keys.
Why this answer
Envelope encryption: GenerateDataKey returns a plaintext data key + its KMS-encrypted copy. The app encrypts data locally with the data key, stores the encrypted data key alongside, and decrypts only via KMS — the data never transits KMS.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Encryption & Key Management practice session.
Practice Encryption & Key Management