Decryption

This diagram shows a graphical representation of how the decryption process works when using SSE-KMS in Amazon S3:

Let's go over the steps in the preceding diagram and see how decryption takes place:

1. A request is received by S3 to access an encrypted object via a client.
2. S3 is aware that the object is encrypted and sends the encrypted data key associated with the object requested to KMS.
3. KMS takes the encrypted data key and uses the original CMK to decrypt the data key to generate a plaintext version of the data key.
4. KMS sends the plaintext data key back to S3.
5. Using the plaintext data key, the encrypted object data can then be decrypted, returning a plaintext version of the object data, and the plaintext data key is deleted from memory.
6. The plaintext object is then sent back to the requesting client.

As you can see, the encryption process follows a logical process of obtaining the keys from KMS from outside of Amazon S3 before performing any encryption operations....