Engineering dive into Slack Enterprise Key Management

This post details the engineering design and implementation of Slack Enterprise Key Management (EKM). It explains the decision to build a separate EKM service using Go for CPU-intensive cryptographic operations and AWS KMS integration. The post describes the use of Customer Master Keys (CMKs) and the generation of data keys with specific scopes (Organization, Workspace, Team, Hour, File) to provide granular control and enable key rotation. It also covers the implementation of an in-memory cache for data keys to improve performance and avoid AWS KMS rate limits, the integration with AWS CloudTrail and CloudWatch for visibility, and how search functionality is handled for encrypted data by encrypting each customer's search index with their Organization scope key.