Security
Envelope Encryption
A data key encrypts the data; a KMS master key encrypts the data key, which is stored beside the ciphertext.
Why interviewers ask about it
Rotating the master key re-encrypts small data keys, not terabytes of data - and bulk encryption never calls the KMS, so throughput is unbounded by it.
This term is part of the free System Design interview preparation module - browse the full glossary for every definition.