Cloud Envelope Encryption & Access Control

Requesting Identity

Controls

Encryption at rest

Request rate 1.0 / s

Threat Detection

NORMAL

Anomaly score0

Granted

Denied

Data exposed?

Objects decrypted

How it works

Cloud object storage almost never encrypts data with one static key. It uses envelope encryption: each object gets its own random Data Encryption Key (DEK), and only that small DEK — not the object — is wrapped by a master Key Encryption Key (KEK) held inside a Key Management Service (KMS):

ciphertext   = Enc_DEK(plaintext)
wrapped_DEK  = Enc_KEK(DEK)          // stored alongside ciphertext
to read:       DEK = Dec_KEK(wrapped_DEK)   -- only inside the KMS
               plaintext = Dec_DEK(ciphertext)

The KEK itself never leaves the KMS. To unwrap a DEK, the KMS first checks an IAM policy — a simple authorization function of (identity, action):

grant(identity, action) = true  iff  identity ∈ allowed_roles(action)

Here Admin and Analyst are in the storage-read policy, so their unwrap requests are granted and the vault decrypts one object (gold flash). Attacker is not in the policy, so the KMS refuses to unwrap the DEK — the request is denied before any plaintext is touched.

Simulate Direct Breach models an attacker who skips IAM entirely and reads the storage bucket straight off disk. With encryption at rest on, they only get ciphertext + a wrapped DEK they cannot open — nothing readable. With it off, the bucket holds plaintext and the breach exposes it immediately, which is why encryption-at-rest is the last line of defense when access control fails.

The anomaly score is an exponentially-weighted moving average of recent security events — denials and breaches push it up, clean grants let it decay — a simplified version of the statistics a real threat-detection pipeline (e.g. AWS GuardDuty, Azure Sentinel) watches to flag credential misuse:

score ← score·(1-α) + eventWeight·α,   α ≈ 0.15
NORMAL  score < 30   ELEVATED  30–65   ALERT  > 65

Granted request Denied / breach KMS vault (KEK)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.

Cloud Envelope Encryption & Access Control Simulator