A computer-implemented method, comprising: under the control of one or more computer systems configured with executable instructions, obtaining (904, 906), based at least in part on a first key inaccessible to a customer of the computing resource service provider and a second key inaccessible to a computing resource service provider, data encrypted under a third key, and an encrypted third key, the encrypted third key being the third key encrypted under at least the first key and the second key, wherein said obtaining includes: generating, by the customer of the computing resource service provider, or receiving, by the customer of the computing resource service provider and from another service provider, the third key; encrypting the third key using the second key; submitting, by the customer of the computing resource service provider, to the computing resource service provider, a request to encrypt the third key that has been encrypted under the second key, using the first key, the request including information enabling the computing resource service provider to select the first key from other information managed on behalf of other customers of the computing resource service provider, and wherein the request further includes the third key that has been encrypted under the second key; receiving, by the customer of the computing resource service provider, in response to the request, the encrypted third key, whereby use of both the first key and the second key is required to decrypt the encrypted third key, using, by the customer of the computing resource service provider, the third key to encrypt data to generate the data encrypted under the third key; after generating the data encrypted under the third key, discarding, by the customer of the computing resource service provider, the third key; and causing, by the customer of the computing resource service provider, the encrypted third key and the data encrypted under the third key to be persisted. obtaining (904, 906), based at least in part on a first key inaccessible to a customer of the computing resource service provider and a second key inaccessible to a computing resource service provider, data encrypted under a third key, and an encrypted third key, the encrypted third key being the third key encrypted under at least the first key and the second key, wherein said obtaining includes: generating, by the customer of the computing resource service provider, or receiving, by the customer of the computing resource service provider and from another service provider, the third key; encrypting the third key using the second key; submitting, by the customer of the computing resource service provider, to the computing resource service provider, a request to encrypt the third key that has been encrypted under the second key, using the first key, the request including information enabling the computing resource service provider to select the first key from other information managed on behalf of other customers of the computing resource service provider, and wherein the request further includes the third key that has been encrypted under the second key; receiving, by the customer of the computing resource service provider, in response to the request, the encrypted third key, whereby use of both the first key and the second key is required to decrypt the encrypted third key, using, by the customer of the computing resource service provider, the third key to encrypt data to generate the data encrypted under the third key; after generating the data encrypted under the third key, discarding, by the customer of the computing resource service provider, the third key; and generating, by the customer of the computing resource service provider, or receiving, by the customer of the computing resource service provider and from another service provider, the third key; encrypting the third key using the second key; submitting, by the customer of the computing resource service provider, to the computing resource service provider, a request to encrypt the third key that has been encrypted under the second key, using the first key, the request including information enabling the computing resource service provider to select the first key from other information managed on behalf of other customers of the computing resource service provider, and wherein the request further includes the third key that has been encrypted under the second key; receiving, by the customer of the computing resource service provider, in response to the request, the encrypted third key, whereby use of both the first key and the second key is required to decrypt the encrypted third key, using, by the customer of the computing resource service provider, the third key to encrypt data to generate the data encrypted under the third key; after generating the data encrypted under the third key, discarding, by the customer of the computing resource service provider, the third key; and causing, by the customer of the computing resource service provider, the encrypted third key and the data encrypted under the third key to be persisted.