Expanding Trust in the Cloud: Utimaco's Integration Unlocks Enhanced Sovereignty Standard for AWS XKS

Data sovereignty is no longer a compliance checkbox. It is a board-level priority.

As organizations accelerate their utilization of multi-cloud environments, the question is no longer if sensitive workloads move to the cloud, but how they stay protected once they get there. Encryption is the foundation of that protection — but encryption is only as strong as the control an organization has over its keys.

Building on the trust established through the existing ESKM and AWS XKS integration, the AWS External Key Store (XKS) capabilities are now expanded with a new double-key-encryption-based Hold Your Own Key (HYOK) model. This enhancement gives regulated organizations an even stronger layer of control, separation, and sovereignty over their data in AWS.

Why Hold Your Own Key Scenarios in AWS XKS matter

AWS XKS allows organizations to protect their AWS resources using cryptographic keys that live outside of AWS, under the customer's own control. This is the foundation of the Hold Your Own Key (HYOK) model.

For decision makers managing compliance across multiple jurisdictions, this matters because:

• AWS never accesses the customers key material, as keys stay outside of the cloud environment.
• Customers retain the ability to revoke access instantly, independent of AWS.
• Regulated industries gain a path to meeting strict data residency and sovereignty mandates, including requirements tied to the US CLOUD Act.

XKS support is central to AWS's digital sovereignty concept — but the value of it depends entirely on how robust the external key management architecture behind it truly is.

How the New Double Envelope Encryption Integration Works

Utimaco & AWS integration introduces a Double Envelope Encryption architecture that strengthens the separation between key material and the data it protects. Data is encrypted first by AWS KMS and then additionally protected using your external key, meaning your data remains strictly tied to your external infrastructure. Here's how it works, step by step:

1.    AWS XKS generates the Data Encryption Key (DEK) used to encrypt the customer's data.
2.    The DEK is sent to Utimaco's Enterprise Secure Key Manager.
3.    Enterprise Secure Key Manager generates a Key Encryption Key (KEK) and uses it to wrap the DEK. The KEK stays with and never leaves ESKM throughout its entire lifecycle. With that this master key stays fully separated from the AWS infrastructure under the customer’s sole control.
4.    AWS stores only the encrypted (wrapped) DEK. Without access to the KEK, this encrypted key is meaningless to AWS or any other party.

This structure creates a clear, auditable separation between encrypted data alongside the key material DEK and the KEK — a distinction that matters enormously when regulators or auditors ask: who, exactly, can access this data?

The Critical Role of HYOK Architectures for Regulated Industries

For organizations in highly regulated industries such as finance, healthcare, and government, lacking trust is a deal breaker. A single gap in key control can mean failed audits, regulatory penalties, or reputational damage that outlasts any cloud migration project.

This HYOK model directly addresses the concerns compliance and security leaders raise most often:

• Full Key Control: Organizations retain full ownership of the KEK, ensuring that encryption control never defaults to the cloud service provider but stays within the organization’s own environment.
• Digital Sovereignty & Compliance: The enhanced HYOK architecture helps organizations meet strict regulatory rules (such as GDPR or Schrems II) by ensuring root keys never leave your physical control or trust boundary.
• Zero Cloud Access to Keys: Because the KEK never leaves Enterprise Secure Key Manager, AWS and any party operating within AWS's infrastructure has zero access to it.

For C-suite leaders navigating the US CLOUD Act and similar cross-border data regulations, this level of separation isn't just a technical nuance. It's the difference between assumed and demonstrable sovereignty.
 

Key Advantages of Utimaco’s Integration with AWS 

Utimaco's enhanced AWS XKS integration delivers measurable advantages for organizations managing complex, multi-cloud security postures:

• Increased Control and Strong Sovereignty
  Full ownership of the KEK ensures encryption and decryption decisions remain with the customer, not the cloud provider.  
• Strict Key Separation
  The HYOK (or 2-key) model enforces a clean boundary between the DEK and the KEK, reducing the risk for exposure and simplifying audit trails.
• Compliance Enablement
  The strategy of double encryption paired with strict separation of the KEK and the DEK unlocks fulfillment of various major regulatory frameworks and helps compliance teams to demonstrate control.
• Expanded AWS Integration Landscape: This enhancement builds directly on Utimaco's established AWS XKS partnership and provides an immediate path to stronger key separation without disrupting existing workflows to organizations using that integration.

Together, these advantages translate into a security posture that scales with the organization's cloud footprint, rather than one that requires constant reconfiguration as cloud usage grows.

The Foundation Behind the Enhanced Sovereignty Standard for AWS XKS: Enterprise Secure Key Manager

The strong foundation of AWS XKS’ enhanced protection and sovereignty capabilities is a key management platform built for security, scale, flexibility, and uncompromising control. That's where Utimaco's Enterprise Secure Key Manager comes in.

As our flagship solution for key management, it provides a single pane of glass for all keys across on-premises and (hybrid) cloud environments with management capabilities for over 2 million keys for more than 25,000 nodes. 

For decision makers evaluating how to strengthen data sovereignty in their AWS environments, Utimaco’s expanded AWS XKS integration offers a proven, auditable path forward.

Visit our website and find out more about Enterprise Secure Key Manager's capabilities and deployment models. 

About the Author

David Phister

Product Management Director for Key Management, Utimaco