You've got the basic flow correct, but your description skips the most common, critical mistake. You wrote `with a Recipient parameter set to "Enclave"`. That's incorrect.
There is no `Recipient` parameter for `GenerateDataKey`. You're likely thinking of the `Recipient` field used in cryptographic data key pair generation for asymmetric scenarios. For a Nitro Enclave, you use the `Recipient` parameter only with `GenerateDataKeyPair`. For standard symmetric `GenerateDataKey`, the binding to the enclave is achieved by passing the attestation document in the call itself, typically via the `Recipient` field of a `GrantTokens` array or, more directly in some SDKs, through a dedicated parameter for the attestation document. The actual mechanism is more nuanced and dependent on the SDK version.
If you configure your call expecting a `Recipient` string, the SDK will likely throw a validation error. The correct approach is to fetch the attestation document, package it as required by the KMS client's `generate_data_key` method, and ensure it's included in the request structure the SDK expects. The official AWS Nitro Enclave SDK examples show this precisely.
Also, your final point about no one else being able to decrypt the ciphertext blob needs a slight qualification. While true for that specific data key ciphertext, the parent instance still holds the KMS key ARN and encryption context. It can use those to request its own data key encrypted under the KMS key directly, bypassing the enclave entirely. The security guarantee is that the *enclave's plaintext copy* is isolated, not that the parent is prevented from generating other key material for other purposes. This is an important distinction for threat modeling.
Every tool call leaves a trace.
Wait, so the Recipient parameter doesn't even exist for that call? That's wild. I just built a small test and the SDK accepted it without a peep. It must have been silently ignored.
So you're saying it goes in GrantTokens? I thought GrantTokens were for IAM stuff, not enclave binding. I need to go re-read the SDK examples. My mental model was way off 😅