Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing client-side decryption for a serverless application. The application retrieves encrypted log archives (each averaging 150 MB150\text{ MB} in size) from an Amazon S3 bucket. The logs were encrypted using envelope encryption with an AWS KMS customer managed key. The encrypted data key is stored as metadata alongside each S3 object.

Which two actions must the developer perform to decrypt the log archives? (Select TWO.)

  1. Call the KMS Decrypt API operation, passing the encrypted data key to retrieve the plaintext data key.Answer
  2. Decrypt the log archive locally using the retrieved plaintext data key and a symmetric decryption algorithm.Answer
  3. C
    Send the encrypted log archive directly to the KMS Decrypt API to be decrypted by AWS KMS.
  4. D
    Call the KMS GetKeyPolicy API to retrieve the private key of the customer managed key to perform local decryption.
  5. E
    Retrieve the plaintext decryption key from the AWS Systems Manager Parameter Store using the GetParameter API.

Answer

To decrypt the log archives, the developer must call the KMS Decrypt API operation, passing the encrypted data key to retrieve the plaintext data key, and then decrypt the log archive locally using the retrieved plaintext data key and a symmetric decryption algorithm.
The correct options identify the proper steps for client-side envelope decryption: first, the client must call the KMS Decrypt API to decrypt the encrypted data key (which is small enough to fit within the 4 KB4\text{ KB} KMS limit); second, the client must perform the decryption of the actual 150 MB150\text{ MB} log file locally using the resulting plaintext data key and a symmetric decryption algorithm. This avoids transmitting large data payloads over the network to KMS.

Step-by-Step Solution

1
Extract the encrypted data key from the S3 object metadata.
The encrypted data key is loaded into the Lambda function's memory.
The encrypted data key must be decrypted before it can be used to decrypt the actual log archive.
2
Invoke the AWS KMS Decrypt API operation, passing the encrypted data key.
AWS KMS returns the plaintext data key.
Only AWS KMS can decrypt the data key because the customer managed key remains secured within the KMS hardware security modules.
3
Decrypt the 150 MB150\text{ MB} log archive locally using the plaintext data key and a symmetric algorithm like AES.
The log archive is successfully decrypted.
Direct decryption via AWS KMS is limited to payloads of 4 KB4\text{ KB} or less, requiring large files to be decrypted locally using envelope encryption.

Key Concept

Envelope encryption is a method where data is encrypted with a unique data key, and the data key itself is encrypted under a root key (an AWS KMS customer managed key). To decrypt the data, the encrypted data key must first be sent to KMS to be decrypted. The resulting plaintext data key is then used locally by the application to decrypt the large payload, avoiding the transmission of large files over the network to KMS.
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic