Encrypt data at rest
Encrypt sensitive data at rest with AES-256-GCM, manage keys via KMS or Vault, handle rotation, and ensure decryption failures fail closed with logging.
Preview
Copy prompt
Implement field-level encryption at rest for [Data type, e.g. PII, payment card data, health records] stored in [Database or file system]. Use AES-256-GCM as the encryption algorithm. Store and manage encryption keys securely using [AWS KMS / HashiCorp Vault / equivalent] so the application never holds plaintext keys in memory longer than necessary. Implement key rotation without requiring a full re-encryption of all existing data in one atomic operation. Ensure that any decryption failure is logged and causes the operation to fail closed rather than returning garbage data.
More
Security
Prompts
