[click170]

This is really cool and reminds me a bit of Mandos which does full disk encryption on headless servers using a network host.

The Readme didn't mention, can this be configured to SMS me when an encryption key is handed out?

[QuinnyPig]

You can have an SNS topic configured to message you on a key creation event via Lambda worst case. We’re talking maybe seven lines of code here.

[randomv]

It uses the GenerateDataKey API against a single master key.

At the client side, yes, could send an SNS notification, or otherwise go indirectly via a Lambda.

Or, alternatively, stream CloudTrail logs through Lambda to achieve a similar result.