When using the AWS Encryption SDK, how does the SDK keep track of the data encryption key (DEK) that was used to encrypt a data object?

The AWS Encryption SDK encrypts the data encryption key (DEK) with one or more wrapping keys (Customer Master Keys or CMKs) and then stores these encrypted DEKs alongside the ciphertext as part of the message format. This design ensures that all necessary information to decrypt the data, including the encrypted DEK, is self-contained within the ciphertext. When decrypting, the SDK extracts the encrypted DEK and uses an available CMK to decrypt it, then uses the decrypted DEK to decrypt the data. Incorrect options: Manually recording DEKs is error-prone and defeats the purpose of the SDK's automated key management. Storing DEKs in Amazon S3 or EC2 user data would introduce additional security risks and management overhead, as these locations are not designed for secure, automatic DEK association with ciphertext.