Passive distribution of encryption keys for distributed data stores

A method, comprising:

• performing, by one or more computing devices:
• maintaining an encrypted data volume in a distributed data store across a plurality of storage nodes;
• providing, by a control plane of the distributed data store, to a client of the distributed data store an encrypted version of one or more keys to decrypt the data volume, wherein the one or more keys are encrypted such that the client of the distributed data store is unable to access the one or more keys;
• receiving, at a storage node of the plurality of storage nodes of the distributed data store, the encrypted one or more keys from the client to enable access to the data volume from the client;
• decrypting, by the storage node, the one or more keys using a different key maintained at the storage node;
• and
• enabling, at the storage node, access to the data volume using the decrypted one or more keys subsequent to decrypting, by the storage node using the different key, the one or more keys received by the distributed data store from the client in encrypted form;
• wherein the distributed data store is a network-based storage service, wherein the client is a network-based database service, and wherein the access is enabled for a read request received from the network-based database service.

A non-transitory, computer-readable storage medium, storing program instructions that when executed by one or more computing devices cause the one or more computing devices to implement:

• maintaining an encrypted data volume in a distributed data store across a plurality of storage nodes;
• encrypting, by a control plane of the distributed data store, one or more permanent keys to decrypt the data volume using a distribution key, wherein the one or more permanent keys are encrypted such that a client of the distributed data store is unable to access the one or more permanent keys;
• sending, by the control plane of the distributed data store, to a client of the distributed data store the encrypted one or more permanent keys;
• receiving, at a storage node of the plurality of storage nodes of the distributed data store, the encrypted one or more permanent keys from the client to enable access to the data volume;
• decrypting, by the storage node, the one or more permanent keys using the distribution key maintained at the storage node;
• and
• enabling, at the storage node, access to the data volume using the decrypted one or more permanent keys subsequent to decrypting, by the storage node using the distribution key, the one or more keys permanent keys received by the distributed data store from the client in encrypted form;
• wherein the distributed data store is a network-based storage service, wherein the client is a network-based database service, and wherein the access is enabled for a read request received from the network-based database service.