---
id: aws-encryption-sdk
version: "4.0.6"
license: Apache License 2.0
license_treatment: permissive
maintenance: active
---

# aws-encryption-sdk — AWS Encryption SDK implementation for Python

License: permissive · Maintenance: active · Downloads: 3.6M/mo

## What it is and what it does

The AWS Encryption SDK for Python provides a native implementation of AWS's encryption standard, enabling you to encrypt and decrypt data using AWS KMS keys. It wraps cryptography, boto3, attrs, and wrapt to manage encryption workflows, supporting both modern keyring-based approaches and legacy master key provider patterns. The library handles data key generation, encryption, and decryption through configurable keyrings or cryptographic materials managers, with built-in support for multi-key scenarios and discovery-based decryption.

The package is designed for developers who need to encrypt sensitive data in Python applications using AWS KMS as the key management backend. It abstracts away the complexity of envelope encryption (encrypting data keys with KMS master keys) and provides a straightforward client API for encrypt/decrypt operations. The library has been in production use since 2017 and is actively maintained by AWS.

Use it for:

- Encrypt application data at rest using AWS KMS keys managed in your AWS account
- Decrypt data encrypted by other AWS Encryption SDK implementations across languages
- Implement multi-key encryption where multiple KMS keys can decrypt the same ciphertext
- Decrypt data when KMS key ARNs are unknown using discovery keyrings with account filters
- Migrate from legacy master key provider patterns to modern keyring-based encryption

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Encrypts and decrypts data using AWS KMS keys and keyrings, implementing the AWS Encryption SDK specification for Python.

Yes. This is a production-grade, actively maintained library from AWS with no known vulnerabilities, permissive licensing, and low install friction. Install it if you need to encrypt/decrypt data with AWS KMS in Python. The modern keyring API requires the optional aws-cryptographic-material-providers library (Python 3.11+), but the core client works with Python 3.8+. The legacy master key provider API is discouraged but still functional.

## Install

pip install aws-encryption-sdk
uv add aws-encryption-sdk
poetry add aws-encryption-sdk

## Installing aws-encryption-sdk

Before you install: Low install friction with a pure-Python wheel. Actively maintained as of 2026-05-07, with recent commits and 253 GitHub stars. Requires cryptography >= 3.4.6, boto3 >= 1.10.0, attrs, and wrapt as runtime dependencies.

License in practice: Apache License 2.0 (permissive) allows commercial and private use with minimal restrictions, making it suitable for most production environments.

Quickstart:

pip install aws-encryption-sdk

import aws_encryption_sdk
from aws_encryption_sdk.identifiers import CommitmentPolicy

client = aws_encryption_sdk.EncryptionSDKClient(
    commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

Requires Python 3.8+. Keyrings and cryptographic material managers require the optional aws-cryptographic-material-providers library (which requires Python 3.11+). System dependencies for cryptography may be needed on some platforms.

Verify before relying:

- Whether the legacy master key provider API is still widely used or if migration to keyrings is now standard practice
- Performance characteristics and throughput limits for large-scale encryption/decryption workloads
- Compatibility guarantees with different AWS KMS key types and regions

## Package facts

- License: Apache License 2.0 (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 3.6M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

aws encryption sdk python, encrypt decrypt with kms, aws data encryption, kms keyring encryption, cryptographic material providers, aws encryption client, envelope encryption aws, aws-kms, envelope-encryption, cryptography

[View on SkillFed](https://skillfed.io/packages/aws-encryption-sdk) · [View on PyPI](https://pypi.org/project/aws-encryption-sdk/)