I'm using Amazon's (AWS) Key Management Service (KMS) to encrypt user data, the KMS uses AES-GCM cryptography.
My problem is that as the AES-GCM key is stored in the KMS and I, as an administrator of my AWS instance, have access to this key and can therefore decrypt user data. My goal is to prevent that.
What can I implement, so that even when I possess the KMS key, I cannot decrypt the user data?
I was thinking that before the user is encrypting data locally with his key stored in KMS, he could encrypt the AES-GCM key with his password that is unknown to AES (and me as the admin). Is that a solution? What algorithms should I use? Thanks!