Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is building a document processing application that must client-side encrypt files up to 15 MB15\text{ MB} in size before uploading them to an Amazon S3 bucket. The application must use a customer managed key in AWS Key Management Service (AWS KMS) for this process. Which of the following actions must the developer perform to implement this client-side encryption workflow? (Select TWO.)

  1. Call the KMS GenerateDataKey API operation using the customer managed key to receive a plaintext data key and an encrypted data key.Answer
  2. Encrypt the file locally using the plaintext data key, then delete the plaintext data key from memory.Answer
  3. C
    Call the KMS Encrypt API operation to encrypt the 15 MB15\text{ MB} file directly using the customer managed key.
  4. D
    Call the KMS GenerateDataKeyWithoutPlaintext API operation, and pass the resulting ciphertext key to AWS Secrets Manager to retrieve the plaintext key.
  5. E
    Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to allow backend components to decrypt the file.

Answer

The correct actions are calling the KMS GenerateDataKey API operation to obtain the plaintext and encrypted data keys, and encrypting the file locally using the plaintext data key while discarding it from memory afterwards.
To implement client-side envelope encryption for large files (such as 15 MB15\text{ MB}), the developer must first call the KMS GenerateDataKey API operation to retrieve both a plaintext and an encrypted data key. The developer then encrypts the file locally using the plaintext key and immediately deletes the plaintext key from memory to prevent leakage, leaving only the encrypted data and the encrypted data key.

Step-by-Step Solution

1
Request a data key from AWS KMS.
Obtained a plaintext data key for encryption and an encrypted version of the same data key (ciphertext data key) for storage.
Because files larger than 4 KB4\text{ KB} cannot be directly encrypted using the KMS Encrypt API due to size limitations, requiring envelope encryption.
2
Encrypt the file locally.
The file is encrypted using the plaintext data key.
The client-side application must perform the bulk data encryption using a local symmetric key rather than transmitting the entire large payload over the network to AWS KMS.
3
Clean up the memory.
The plaintext data key is purged from the application memory.
To ensure security best practices are followed and the plaintext key is not exposed or leaked.

Key Concept

AWS KMS Envelope Encryption Workflow for Large Payloads
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic