Envelope encryption
Envelope encryption is the pattern behind most encryption at rest in cloud platforms: data is encrypted with a data key, and that data key is then encrypted with a key encryption key held in a key management service. The wrapped data key is stored next to the ciphertext, and the master key never leaves the service.
It exists for two practical reasons. Sending large volumes of data through a KMS would be slow and expensive, so bulk encryption happens locally with a key generated for the purpose, and only that small key is sent to be wrapped. And rotating the master key becomes cheap: rewrapping the data keys is enough, and terabytes of ciphertext do not have to be rewritten.
The security property is that the master key is never released, so an attacker who copies the storage gets ciphertext and a wrapped key they cannot open. The property that gets overlooked is the corollary. Anyone who can call the unwrap operation on that master key can read the data, without ever seeing a key, and that permission is an identity and access decision rather than a cryptographic one.
This is why encryption at rest in a cloud estate is frequently a weaker statement than it sounds. If the role attached to a compromised workload can decrypt, then so can we, and the ciphertext was never a barrier. What we examine is the key policy: which identities may decrypt, whether the permission is constrained by conditions, whether a separate key is used per environment and data classification, and whether decrypt calls are logged in a way that would let anyone notice bulk access. That review is part of the cloud testing where we check who is allowed to call decrypt.