TechPrufer
Get started
Slack
Slack logoSlack · Feature trail

Enterprise Key Management (EKM)

2 posts · Mar 2019 – May 2026

What this trail covers

This thread tracks the evolution of Slack's Enterprise Key Management (EKM) system, enabling customers to control the encryption keys for their data. Initial posts detail the design and implementation of EKM, allowing organizations to bring their own encryption keys (initially via AWS KMS) to encrypt and decrypt their data within Slack. This includes granular control through scopes (Organization, Workspace, Team, Hour, File) and integration with AWS KMS for key management. The system also addresses the challenges of multi-cloud orchestration for LLM serving, moving from SageMaker to Bedrock Provisioned Throughput, and then to Bedrock On-Demand with a hybrid routing strategy to balance performance, cost, and agility. The evolution includes managing LLM model access, infrastructure efficiency, and engineering for resilience through model hierarchies and regional routing.

All Slack trails
  1. Slack AI: The Path to Multi-CloudThis post details the evolution of Slack's LLM serving infrastructure from Phase 1 (SageMaker) to Phase 2 (Amazon Bedrock Provisioned Throughput) and then to Phase 3 (Amazon Bedrock On-Demand with a Hybrid Routing strategy). It highlights the trade-offs encountered at each stage, including scaling latency, hardware scarcity, feature lag, operational simplicity, infrastructure efficiency, and the final efficiency gap of over-provisioning and commitment lock-in with Provisioned Throughput. The transition to On-Demand addresses the idle capacity problem and provides architectural agility. The hybrid strategy balances performance and fluency by keeping latency-sensitive features on Provisioned Throughput and bursty workloads on On-Demand, with a spillover pattern for surges. Engineering for resilience involves a model hierarchy for automatic fallback to different models and regional routing.
  2. Engineering dive into Slack Enterprise Key ManagementThis post details the engineering design and implementation of Slack Enterprise Key Management (EKM). It explains the decision to build a separate EKM service using Go for CPU-intensive cryptographic operations and AWS KMS integration. The post describes the use of Customer Master Keys (CMKs) and the generation of data keys with specific scopes (Organization, Workspace, Team, Hour, File) to provide granular control and enable key rotation. It also covers the implementation of an in-memory cache for data keys to improve performance and avoid AWS KMS rate limits, the integration with AWS CloudTrail and CloudWatch for visibility, and how search functionality is handled for encrypted data by encrypting each customer's search index with their Organization scope key.