Choosing Between Vault Transit and KV v2 for Field-Level Encryption
Decide whether to protect application fields with Vault Transit envelope encryption or KV v2 secret storage, including CLI validation and rollback.
Loading…
vault
KMS Envelope Encryption in Lambda: Generate Data Keys Once, Encrypt Without Repeated KMS Calls
Use KMS GenerateDataKey to encrypt customer data locally in Lambda, store the encrypted data key with the ciphertext, and avoid per-record KMS calls. Includes a working Python example and verification steps.