mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-03 17:30:19 +03:00

Files

T

Mahipal 2fb6a9faff Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

2026-08-02 09:32:13 -07:00

3.7 KiB

Raw Blame History

name, description, domain, subdomain, tags, version, author, license, nist_csf, mitre_attack

name

description

domain

subdomain

Implementing Envelope Encryption with AWS KMS

Overview

Envelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting large volumes of data locally while keeping the master key secure in a hardware security module (HSM) managed by AWS. This skill covers implementing envelope encryption using AWS KMS GenerateDataKey API.

When to Use

When deploying or configuring implementing envelope encryption with aws kms capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Understand the envelope encryption pattern and its advantages
Generate data encryption keys using AWS KMS GenerateDataKey
Encrypt/decrypt data locally using DEKs
Store encrypted DEK alongside ciphertext
Implement key caching to reduce KMS API calls
Handle key rotation with automatic re-encryption
Implement multi-region encryption for disaster recovery

Key Concepts

Envelope Encryption Flow

Call kms:GenerateDataKey to get plaintext DEK + encrypted DEK
Use plaintext DEK to encrypt data locally (AES-256-GCM)
Store encrypted DEK alongside ciphertext
Discard plaintext DEK from memory
For decryption: call kms:Decrypt on encrypted DEK, then decrypt data

Advantages Over Direct KMS Encryption

Aspect	Direct KMS	Envelope Encryption
Max data size	4 KB	Unlimited
Latency	Network round-trip per operation	Local encryption
Cost	$0.03/10,000 requests	Fewer KMS requests
Offline	Not possible	Yes (with cached DEKs)

KMS Key Types

AWS Managed: AWS creates and manages (aws/s3, aws/ebs)
Customer Managed: You create and manage policies
Custom Key Store: Backed by CloudHSM cluster

Security Considerations

Never store plaintext DEK; only keep encrypted DEK
Use key policies to restrict who can call GenerateDataKey and Decrypt
Enable AWS CloudTrail logging for all KMS API calls
Implement key rotation (automatic annual rotation for CMKs)
Use encryption context for authenticated encryption metadata
Handle KMS throttling with exponential backoff

Validation Criteria

GenerateDataKey returns plaintext and encrypted DEK
Data encrypts correctly with plaintext DEK using AES-256-GCM
Encrypted DEK can be decrypted via KMS Decrypt API
Decrypted DEK recovers the original data
Plaintext DEK is wiped from memory after use
Encryption context is validated during decryption
Key rotation re-encrypts DEKs with new master key

3.7 KiB Raw Blame History