Examkin

Question

Difficulty: HardAWS KMS and Encryption

A developer is designing a containerized microservice on Amazon ECS that processes and stores sensitive customer profiles. During a compliance audit, the security team mandates that any profile larger than 4 KB4\text{ KB} must be encrypted before being written to an external database. The microservice must also retrieve and decrypt these profiles. Additionally, the database credentials used by the microservice must be rotated automatically every 30 days.

Which combination of AWS services and programmatic workflows should the developer implement to meet these requirements?

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation. For customer profiles, implement client-side envelope encryption by calling the KMS GenerateDataKey API to obtain a plaintext data key and a ciphertext data key, encrypting the profile locally with the plaintext data key, and storing the ciphertext data key along with the encrypted profile.Answer
  2. B
    Store the database credentials and customer profiles in AWS Systems Manager Parameter Store, and enable automatic parameter rotation. For customer profiles larger than 4 KB4\text{ KB}, call the KMS Encrypt API directly to encrypt the profiles in a single API call before saving them.
  3. C
    Store the database credentials in AWS Secrets Manager and enable automatic rotation. For customer profiles, call the KMS GenerateDataKeyWithoutPlaintext API to obtain an encrypted data key, use it to encrypt the profiles locally using a symmetric encryption library, and store the encrypted profile.
  4. D
    Store the database credentials in AWS KMS and enable automatic rotation of the Customer Managed Key. For customer profiles, call the KMS Encrypt API directly for profiles smaller than 4 KB4\text{ KB}, and for profiles larger than 4 KB4\text{ KB}, split the payload into 4 KB4\text{ KB} chunks and call the Encrypt API for each chunk.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation, and use client-side envelope encryption with the KMS GenerateDataKey API to encrypt and decrypt the large customer profiles.
The correct option correctly identifies AWS Secrets Manager for storing and automatically rotating database credentials. It also correctly specifies the client-side envelope encryption workflow using the KMS GenerateDataKey API to obtain both plaintext and ciphertext data keys, allowing the application to encrypt the large profile payload locally.

Step-by-Step Solution

1
Analyze the file size constraint and encryption method.
Since customer profiles exceed the 4 KB4\text{ KB} (4096 bytes) payload limit of the KMS direct encryption APIs (such as Encrypt), client-side envelope encryption must be used.
Direct encryption with KMS is restricted to small data sizes, whereas envelope encryption allows encrypting data of any size locally using a data key generated by KMS.
2
Select the correct KMS API for generating the data key.
Call the GenerateDataKey API to receive both the plaintext data key and the ciphertext (encrypted) data key.
The application needs the plaintext key to encrypt the profile locally using a symmetric algorithm. GenerateDataKeyWithoutPlaintext only returns the ciphertext key, which cannot be used for encryption without an additional Decrypt call.
3
Determine the service and mechanism for credentials storage and rotation.
Store database credentials in AWS Secrets Manager and enable automatic rotation.
AWS Secrets Manager natively supports automatic rotation of database credentials, whereas AWS KMS manages cryptographic keys rather than credentials, and Systems Manager Parameter Store does not offer built-in automatic rotation.

Key Concept

AWS KMS envelope encryption and secrets rotation constraints
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic