An organization receives large, encrypted backup archives from an external partner. The partner encrypts these archives using envelope encryption with an AWS KMS customer managed key (CMK). Along with each archive, the partner provides the encrypted data key (ciphertext data key). Which sequence of actions must a developer implement in the decryption utility to retrieve the original plaintext data?
- Send the ciphertext data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the archive locally using the plaintext data key, and then remove the plaintext data key from memory.Answer
- BSend the entire encrypted archive to the AWS KMS Decrypt API operation to perform decryption on the service side, and then write the returned plaintext payload to local storage.
- CSend the ciphertext data key to the AWS KMS GenerateDataKey API operation to generate the corresponding plaintext data key, and then decrypt the archive locally.
- DStore the ciphertext data key in AWS Systems Manager Parameter Store as a SecureString, configure a lifecycle policy to automatically decrypt the key, and then retrieve the plaintext value.
Answer
Send the ciphertext data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the archive locally using the plaintext data key, and then remove the plaintext data key from memory.
In envelope encryption, data is encrypted locally using a unique symmetric data key. To decrypt the data, the application sends the ciphertext data key to AWS KMS using the Decrypt API operation. AWS KMS decrypts the key using the customer managed key and returns the plaintext data key. The application then performs the decryption locally on the large archive using the plaintext key, and then deletes the plaintext key from memory to prevent security leaks.
Step-by-Step Solution
Key Concept
AWS KMS Envelope Decryption Workflow
Estimated Time:1m 30s