Examkin

Question

Difficulty: MediumAWS KMS and Encryption

An application running on AWS Fargate generates monthly audit reports (each approximately 8 MB8\text{ MB} in size) that must be encrypted client-side before they are stored in an external third-party storage system. The developer wants to use AWS Key Management Service (AWS KMS) with a customer managed key to secure these reports.

Which of the following actions must the developer take to implement this client-side encryption workflow? (Select TWO.)

  1. Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.Answer
  2. B
    Call the Encrypt API of AWS KMS to encrypt the audit report directly.
  3. C
    Call the GenerateDataKeyWithoutPlaintext API of AWS KMS to obtain an encrypted data key, and use it to encrypt the audit report locally.
  4. Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.Answer
  5. E
    Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString to reuse it for subsequent audit reports.

Answer

To encrypt a file larger than 4 KB4\text{ KB} client-side, the developer must generate a data key by calling the GenerateDataKey API, use the returned plaintext data key to encrypt the report locally, discard the plaintext key from memory, and store the encrypted data key alongside the encrypted audit report.
To encrypt a large file client-side using AWS KMS, the developer must implement envelope encryption. This involves calling the GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the audit report locally, after which the plaintext key is discarded from memory. The encrypted data key is then stored with the encrypted report so that it can be decrypted later by calling the Decrypt API to recover the plaintext key.

Step-by-Step Solution

1
Generate a unique data key.
The GenerateDataKey API is called, which returns a plaintext data key and an encrypted data key.
Since the file exceeds the direct encryption limit of AWS KMS, envelope encryption is required. The plaintext key is needed to perform the encryption, and the encrypted key is saved for future decryption.
2
Encrypt the data locally.
The Fargate container encrypts the 8 MB8\text{ MB} report using the plaintext data key.
This performs the actual cryptographic operation locally without sending the large file to AWS KMS.
3
Clean up memory and store metadata.
The plaintext key is cleared from the container's memory, and the encrypted data key is written alongside the encrypted report.
Holding the plaintext key longer than necessary in memory presents a security risk, and the encrypted data key is the only way to recover the plaintext key during decryption.

Key Concept

AWS KMS client-side envelope encryption workflow for objects exceeding the direct encryption size limits.
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic