Examkin

Question

Difficulty: Very hardAWS KMS and Encryption

A developer is designing a secure file upload utility for a containerized microservice. The utility must encrypt files up to 100 MB100\text{ MB} locally before uploading them to an Amazon S3 bucket named `my-app-data`. To comply with strict security and auditing guidelines, the solution must satisfy the following requirements:

1. Ensure that plaintext data keys are never persisted or stored in any AWS service.
2. Prevent unauthorized decryption if the encrypted files are copied to a different S3 bucket.
3. Minimize AWS KMS API calls to avoid rate-limiting/throttling and control costs.
4. Record all cryptographic key usage in AWS CloudTrail for auditing.

Which KMS API workflow and architecture meets these requirements?

  1. Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned plaintext data key to encrypt the file locally using a symmetric encryption library, immediately delete the plaintext key from memory, and upload the encrypted file to S3 with the ciphertext data key stored in the object's user-defined metadata.Answer
  2. B
    Call the KMS `GenerateDataKeyWithoutPlaintext` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned ciphertext data key to encrypt the file locally, then call the KMS `Decrypt` API to retrieve the plaintext key for validation before uploading the encrypted file to S3.
  3. C
    Divide each file into 4 KB4\text{ KB} chunks. For each chunk, call the KMS `Encrypt` API using the Customer Managed Key (CMK) and passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Concatenate the resulting ciphertext chunks and upload the final encrypted payload to the S3 bucket.
  4. D
    Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK). Use the returned plaintext data key to encrypt the file locally. Store the plaintext data key in AWS Secrets Manager under a dynamic path like `/keys/my-app-data/data-key`, configure the secret to auto-delete after 15 minutes, and upload the encrypted file to S3.

Answer

Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned plaintext data key to encrypt the file locally using a symmetric encryption library, immediately delete the plaintext key from memory, and upload the encrypted file to S3 with the ciphertext data key stored in the object's user-defined metadata.
The correct workflow uses `GenerateDataKey` with an `EncryptionContext` of the target bucket. This generates both the plaintext key (needed to perform the encryption locally) and the ciphertext key. The plaintext key is used to encrypt the payload and is immediately discarded. The ciphertext key is stored in the object's S3 metadata. Binding the bucket name via `EncryptionContext` ensures that if the object is copied to another bucket, decryption will fail because the context won't match the new bucket name.

Step-by-Step Solution

1
Request a data key from KMS with bucket context.
Receive both a plaintext data key and a ciphertext data key cryptographically bound to the bucket name via `EncryptionContext`.
This establishes the client-side envelope encryption workflow and enforces the security boundary constraint.
2
Encrypt the file payload locally.
The file is encrypted using a local symmetric library (like AES-GCM) with the plaintext data key.
This keeps encryption client-side, handles payloads larger than the KMS 4 KB direct encryption limit, and reduces network latency.
3
Secure memory and prepare metadata.
The plaintext data key is purged from the application's memory, leaving only the ciphertext data key.
This minimizes the lifetime of the plaintext key in memory, satisfying the security requirements.
4
Upload the encrypted file and metadata.
The encrypted file is uploaded to the S3 bucket, with the ciphertext data key stored in S3 metadata.
This keeps the encrypted payload and its decryptable key together, allowing decryption later only if the exact bucket context is provided to the KMS Decrypt API.

Key Concept

AWS KMS Client-Side Envelope Encryption and EncryptionContext Bindings
Estimated Time:3m 0s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic