Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is designing a microservice that processes sensitive transaction payloads of approximately 1.5 MB1.5\text{ MB} each. The microservice must encrypt these payloads before storing them in an on-premises database. The encryption keys must be managed in AWS KMS. Which approach should the developer use to perform the encryption in a secure and efficient manner?

  1. A
    Call the Encrypt API operation directly, passing the payload and the customer managed key identifier, then store the resulting ciphertext in the database.
  2. B
    Store the transaction payloads directly in AWS Systems Manager Parameter Store as SecureString parameters, configuring Parameter Store to use the KMS customer managed key for encryption.
  3. Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.Answer
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation to obtain an encrypted data key. Decrypt the key locally using a client-side cryptographic library, use it to encrypt the payload, and discard the key.

Answer

Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.
For data larger than 4 KB4\text{ KB}, developers must use envelope encryption. Calling the GenerateDataKey API provides a plaintext data key to perform local symmetric encryption of the 1.5 MB1.5\text{ MB} payload and an encrypted copy of the data key. Once encryption is complete, the plaintext data key is discarded from memory, and the encrypted payload is stored alongside the encrypted data key. The encrypted data key can later be sent to KMS Decrypt to retrieve the plaintext key for decryption.

Step-by-Step Solution

1
Identify the size limit of the direct KMS Encrypt API and compare it to the transaction payload size.
The transaction payload is 1.5 MB1.5\text{ MB}, which exceeds the 4 KB4\text{ KB} limit of the direct KMS Encrypt API.
KMS direct encryption cannot process payloads larger than 4 KB4\text{ KB}, requiring the use of envelope encryption.
2
Evaluate the options for envelope encryption using AWS KMS APIs.
Calling GenerateDataKey provides both the plaintext data key for local encryption and the encrypted data key for storage.
GenerateDataKey generates the keys locally without transmitting the actual data payload to KMS, which is highly efficient.
3
Complete the envelope encryption workflow locally on the client.
The plaintext key encrypts the payload, is removed from memory, and the encrypted payload is stored with the encrypted data key.
This ensures the plaintext key is not exposed and the data can be decrypted later by decrypting the data key with KMS.

Key Concept

KMS Envelope Encryption and API Limits
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic