AWS KMS has a great whitepaper explaining how they do it here: https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf https://d0.awsstatic.com/white

AWS KMS has a great whitepaper explaining how they do it here: https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Detai... The tl;dr is that they use hardware security modules (HSMs) with quorum-based access controls. Any administrative actions such as deploying software or changing the list of authorized operators requires a quorum of operators to sign a command for that action using their respective private keys. While this system was designed specifically around protecting customers' private keys, you could imagine a similar system around large databases.