An application under development is required to store hundreds of video files. The data must be encrypted within the application prior to storage, with a unique key for each video file. How should the

The KMS Encrypt API is limited to data up to 4 KB; it cannot directly encrypt large video files and does not implement envelope encryption with per-file unique keys.

Generating keys entirely within a cryptography library means the keys are never protected by KMS; key management, rotation, and auditing responsibilities fall entirely on the application, which is error-prone and non-compliant.

KMS GenerateDataKey returns both a plaintext data key and a KMS-encrypted copy of that key. The application uses the plaintext key to encrypt the video file locally, immediately discards the plaintext key from memory, and stores only the encrypted data key alongside the encrypted video. For each new file the process repeats, producing a unique key per file as required, while KMS retains the master key used to decrypt the data keys on demand.

S3 server-side encryption applies encryption at the storage layer, not within the application as required; additionally, SSE-KMS uses a single CMK for all objects unless explicitly configured per object, not guaranteeing a unique key per video file.