Examkin

Question

Difficulty: MediumAWS KMS and Encryption

An IoT analytics platform receives telemetry batches of approximately 8 MB8\text{ MB} in size from edge gateways. The data must be encrypted client-side before it is transmitted to Amazon S3. A developer is tasked with implementing this encryption using a Customer Managed Key (CMK) in AWS KMS. Which two actions must the developer perform to successfully implement this encryption workflow? (Select TWO.)

  1. Call the AWS KMS GenerateDataKey API specifying the Customer Managed Key to obtain both a plaintext data key and a ciphertext data key.Answer
  2. Encrypt the telemetry batch locally using the plaintext data key, and then discard the plaintext data key from memory.Answer
  3. C
    Call the AWS KMS Encrypt API directly, passing the telemetry batch as the plaintext parameter.
  4. D
    Call the AWS KMS GenerateDataKeyWithoutPlaintext API to retrieve only the ciphertext data key, and decrypt it locally using the AWS SDK.
  5. E
    Store the plaintext data key in AWS Systems Manager Parameter Store as a secure string with automatic rotation enabled.

Answer

To encrypt payloads larger than 4 KB4\text{ KB} client-side, the developer must use envelope encryption. This is done by calling GenerateDataKey to obtain both plaintext and ciphertext data keys, encrypting the data locally with the plaintext key, and then discarding the plaintext key from memory.
For payloads larger than 4 KB4\text{ KB} (such as the 8 MB8\text{ MB} telemetry batch), direct encryption using AWS KMS is not possible. The developer must implement envelope encryption. This involves calling the `GenerateDataKey` API to get both a plaintext data key and a ciphertext data key. The plaintext data key is used to encrypt the telemetry batch locally and is then deleted from memory. The ciphertext data key is stored with the encrypted data in Amazon S3 for later decryption.

Step-by-Step Solution

1
Generate cryptographic keys
Retrieve a plaintext data key and a ciphertext data key from AWS KMS.
Because the telemetry batch size (8 MB8\text{ MB}) exceeds the direct KMS encryption limit of 4 KB4\text{ KB}, envelope encryption is required.
2
Perform client-side encryption
Encrypt the telemetry batch using the plaintext data key locally.
This secures the data on the client side before transmission.
3
Clean up sensitive data in memory
Erase the plaintext data key from memory and store the ciphertext data key alongside the encrypted payload.
To prevent exposure of the plaintext key, and to ensure the data can be decrypted later using the ciphertext key.

Key Concept

AWS KMS envelope encryption workflow for handling large datasets.
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic