aws-encryption-sdk

What it is and what it does

The AWS Encryption SDK for Python provides a native implementation of AWS's encryption standard, enabling you to encrypt and decrypt data using AWS KMS keys. It wraps cryptography, boto3, attrs, and wrapt to manage encryption workflows, supporting both modern keyring-based approaches and legacy master key provider patterns. The library handles data key generation, encryption, and decryption through configurable keyrings or cryptographic materials managers, with built-in support for multi-key scenarios and discovery-based decryption.

The package is designed for developers who need to encrypt sensitive data in Python applications using AWS KMS as the key management backend. It abstracts away the complexity of envelope encryption (encrypting data keys with KMS master keys) and provides a straightforward client API for encrypt/decrypt operations. The library has been in production use since 2017 and is actively maintained by AWS.

Use it for:

• Encrypt application data at rest using AWS KMS keys managed in your AWS account
• Decrypt data encrypted by other AWS Encryption SDK implementations across languages
• Implement multi-key encryption where multiple KMS keys can decrypt the same ciphertext
• Decrypt data when KMS key ARNs are unknown using discovery keyrings with account filters
• Migrate from legacy master key provider patterns to modern keyring-based encryption

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Encrypts and decrypts data using AWS KMS keys and keyrings, implementing the AWS Encryption SDK specification for Python.

Yes. This is a production-grade, actively maintained library from AWS with no known vulnerabilities, permissive licensing, and low install friction. Install it if you need to encrypt/decrypt data with AWS KMS in Python. The modern keyring API requires the optional aws-cryptographic-material-providers library (Python 3.11+), but the core client works with Python 3.8+. The legacy master key provider API is discouraged but still functional.

Install

aws-encryption-sdk on PyPI

pip install aws-encryption-sdk

uv add aws-encryption-sdk

poetry add aws-encryption-sdk

Installing aws-encryption-sdk

Before you install

Low install friction with a pure-Python wheel. Actively maintained as of 2026-05-07, with recent commits and 253 GitHub stars. Requires cryptography >= 3.4.6, boto3 >= 1.10.0, attrs, and wrapt as runtime dependencies.

License in practice

Apache License 2.0 (permissive) allows commercial and private use with minimal restrictions, making it suitable for most production environments.

Quickstart

pip install aws-encryption-sdk

import aws_encryption_sdk
from aws_encryption_sdk.identifiers import CommitmentPolicy

client = aws_encryption_sdk.EncryptionSDKClient(
    commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

Requires Python 3.8+. Keyrings and cryptographic material managers require the optional aws-cryptographic-material-providers library (which requires Python 3.11+). System dependencies for cryptography may be needed on some platforms.

Verify before relying

• Whether the legacy master key provider API is still widely used or if migration to keyrings is now standard practice
• Performance characteristics and throughput limits for large-scale encryption/decryption workloads
• Compatibility guarantees with different AWS KMS key types and regions

Package facts

Evidence: aws_encryption_sdk-4.0.6-py2.py3-none-any.whl

Keywords: aws-encryption-sdk, aws, kms, encryption

Tags

More Security packages