A developer is designing an application that must encrypt large payload files locally before sending them to an external storage system. The developer wants to implement client-side envelope encryption using an AWS KMS customer managed key. Which of the following actions must the developer perform to implement this encryption workflow? (Select TWO.)
- Call the AWS KMS GenerateDataKey API operation using the customer managed key to retrieve a plaintext data key and a ciphertext data key.Answer
- Encrypt the payload locally using the plaintext data key, and then delete the plaintext data key from application memory.Answer
- CCall the AWS KMS Encrypt API operation directly with the large payload and the customer managed key.
- DCall the AWS KMS GenerateDataKeyWithoutPlaintext API operation, and use the returned ciphertext data key to encrypt the payload.
- EStore the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter for subsequent local encryption operations.
Answer
To implement client-side envelope encryption, the developer must call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and a ciphertext data key, encrypt the payload locally using the plaintext data key, and then delete the plaintext data key from memory.
In envelope encryption, the developer first obtains both a plaintext and a ciphertext data key by calling the GenerateDataKey API with a customer managed key. The plaintext data key is used to encrypt the payload locally, and then the plaintext key is immediately destroyed from memory to maintain security. The ciphertext data key is stored alongside the encrypted payload.
Step-by-Step Solution
Key Concept
Envelope encryption is the practice of encrypting data with a data key, and then encrypting the data key under another key (the KMS key). This workflow allows local encryption of large datasets without sending the actual data to KMS.