Apologies if this has been asked before.
I am looking to encrypt documents before storing in the cloud.
There will be a separate metadata storage, which could be either internal or cloud hosted.
My strategy would be to generate a new symmetric key for each document (or batch of documents if key generation is expensive), and then to encrypt the key used with another 'global' key (symmetric or asymmetric) and recording this encrypted key within the metadata storage.
The documents are safe so long as the global key is not compromised, but it could make key management easier since changing the global key means reencrypting the key used in metadata only, rather than having to reencrypt the cloud hosted document.
Does this sound a sensible strategy, or is there a better one you could recommend?