Overview

Encryption Gateway lets a customer protect their data with a key in AWS KMS, Google Cloud KMS, or Azure Key Vault—without giving your application their cloud credentials.

There are three ways to use it. Pick the one that matches where the data is stored.

Data your application stores     → Encrypt/Decrypt API
Storage built with Alien         → attach a Key to the resource
S3, Aurora, EBS, and other AWS   → AWS Virtual Key

Encrypt application records

Your backend sends data to the Encrypt/Decrypt API. Alien encrypts it under a root protected by that customer’s KMS key.

const encrypted = await fetch("https://encryption.alien.dev/v1/encrypt", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ALIEN_ENCRYPTION_API_KEY}`,
    "X-Alien-External-ID": customer.id,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    key: { keyId: "customer-data" },
    plaintext: Buffer.from(value).toString("base64"),
  }),
}).then(response => response.json())

Use this for fields, documents, credentials, or other data your application stores itself.

Encrypt a resource built with Alien

Attach a Key to a supported resource in alien.ts. Alien carries the relationship into every customer deployment.

import * as alien from "@alienplatform/core"

const customerKey = new alien.Key("customer-key").build()
const data = new alien.Storage("customer-data")
  .encryptionKey(customerKey)
  .build()

export default new alien.Stack("app")
  .add(customerKey, "frozen", { remoteAccess: true })
  .add(data, "frozen")
  .build()

See Native resource encryption.

Encrypt AWS resources with a Virtual Key

For S3, Aurora, EBS, and other AWS services, create a normal AWS KMS key backed by Alien’s External Key Store integration. Your resource uses the KMS key ARN as usual.

Your application keeps using the AWS SDK or passes a normal KMS key ARN to S3, Aurora, or EBS. See AWS Virtual Keys.

Use this when AWS already knows how to encrypt the resource and you do not want your application to call a separate encryption API.