Envelope Encryption
Encrypting data with a locally-generated data key, then encrypting that key with a master key held in a key management service, and storing the wrapped key alongside the ciphertext.
The pattern behind essentially all cloud encryption at rest, and it exists to solve a practical problem: sending every byte of data to a key management service to be encrypted would be slow, expensive and rate-limited.
Instead the KMS generates a data key and returns it twice — in plaintext and encrypted under the master key. The application encrypts the data locally with the plaintext data key, discards it from memory, and stores the encrypted data key next to the ciphertext. Decryption reverses it: send the wrapped key to the KMS, receive the plaintext data key, decrypt locally.
Why it is a good design. Master keys never leave the KMS, so they cannot be exfiltrated. Rotating the master key requires re-encrypting only the data keys, not the data itself — which is what makes rotation feasible on petabyte datasets. Each object can have its own data key, so compromise of one does not extend. And KMS calls scale with key operations, not data volume.
The operational consequences: the KMS is on the critical path for decryption, so its availability and its request quota matter; and destroying a master key destroys everything under it, which is the mechanism behind crypto-shredding and also a way to lose data permanently.