A KEK (Key Encryption Key) is the intermediate key in the BYOK setup. Its role:
- It's derived from the master key, taking context into account
- It's used to encrypt DEKs
- Each data type gets its own KEK
- It isn't stored anywhere, it's generated on demand
The chain looks like this: master key (in your KMS) → KEK (derived) → DEK (for data). Compromising one KEK doesn't give access to any other data.
Learn more in the Help center
Read the article →