A Lambda function must encrypt large payloads before writing them to S3, with keys managed under centralized control and rotation. The AWS Encryption SDK is used. What does 'envelope encryption' mean in this design?
A.The KMS master key encrypts the payload directly
KMS Encrypt API caps at 4 KB — it wraps keys, not bulk data.
B.A data key encrypts the payload; KMS encrypts (wraps) the data key
Correct. Data key encrypts data; KMS key encrypts the data key.
C.Two KMS keys encrypt the payload twice for redundancy
Double-KMS isn't the pattern — one wrapped data key is.
D.TLS encrypts the data in transit to S3
TLS protects transit, not data at rest.
Why this answer
Envelope encryption: the SDK generates a data key, encrypts data locally with it (fast, no size limits), then KMS encrypts that data key with the KMS key. Only the wrapped data key travels/stores — KMS never sees the payload.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security