GenerateDataKey

Source: src/AWS/KMS/GenerateDataKey.ts

Runtime binding for kms:GenerateDataKey.

Bind this operation to a KMS Key (or the alias/... name of a pre-existing key) inside a function runtime to get a callable that automatically injects the KeyId. Returns a fresh symmetric data key as both plaintext (for immediate envelope encryption outside KMS) and a ciphertext blob encrypted under the bound key (for storage alongside the data). Decrypt the stored blob later with the Decrypt binding.

The Plaintext data key in the response is wrapped in Redacted so it never leaks into logs — unwrap with Redacted.value(...) at the point of use and discard it as soon as the envelope operation is done.

Envelope Encryption

Generate a Data Key

import * as Redacted from "effect/Redacted";

const generateDataKey = yield* AWS.KMS.GenerateDataKey(key);

const response = yield* generateDataKey({ KeySpec: "AES_256" });
const dataKey = Redacted.isRedacted(response.Plaintext)
  ? Redacted.value(response.Plaintext)
  : response.Plaintext; // 32-byte Uint8Array — use, then discard
const stored = response.CiphertextBlob; // persist next to the data

Recover the Data Key Later

const decrypt = yield* AWS.KMS.Decrypt(key);
const recovered = yield* decrypt({ CiphertextBlob: stored });

Pre-Existing Keys

const generateDataKey = yield* AWS.KMS.GenerateDataKey("alias/app-key");

Wiring

// Envelope encryption pairs GenerateDataKey with Decrypt — provide
// both HTTP layers on the Function's init Effect.
export default EnvelopeFunction.make(
  { main: import.meta.url, url: true },
  Effect.gen(function* () {
    const key = yield* AWS.KMS.Key("DataKey");
    const generateDataKey = yield* AWS.KMS.GenerateDataKey(key);
    const decrypt = yield* AWS.KMS.Decrypt(key);
    // ... generate a data key, encrypt locally, store the CiphertextBlob
    return { fetch: handler };
  }).pipe(
    Effect.provide(
      Layer.mergeAll(AWS.KMS.GenerateDataKeyHttp, AWS.KMS.DecryptHttp),
    ),
  ),
);