The service can decrypt ciphertext submitted by a user with a managed key and return the plaintext without exposing the key material.
Decrypt Data
CCC.KeyMgmt.CP10
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.TH02 | A KMS Key is Used to Decrypt Data Without Restriction | Misconfigured permissions that allow broad invocation of the Decrypt API can expose plaintext data, enabling unintended disclosure or exfiltration of sensitive information. |
| CCC.KeyMgmt.TH09 | External Key Store is Unavailable or Compromised | When keys are held in an external key manager, every encrypt and decrypt request depends on a network path to, and the correct operation of, infrastructure outside the provider. Loss of that path or of the external system halts all operations with those keys, and compromise of the external system exposes the key material or the plaintext data keys that pass through it. Availability of every workload that depends on the keys and confidentiality of the data they protect are affected. |