For my use case, I need to maintain a secret key with the client to generate and verify HMAC for requests.
We can have multiple clients and we can not make assumptions such as a client's server will always reside in EC2.
I am considering envelop encryption for our secret keys using AWS KMS. I have the following concerns:
Secret key will be transferred over the wire as plain text to be encrypted and after decryption by KMS, is this a safe practice?
We will need to store AWS credentials in plain text on servers (our server as well as client's) to call KMS, how is it better than storing the secret key itself? (Given that we could share the secret key once, say in a registration successful email)