Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing a client-side decryption module for a batch processing application. The application downloads encrypted data archives (each approximately 18 MB18\text{ MB} in size) from an Amazon S3 bucket. Each archive was previously encrypted using envelope encryption with a customer managed key (CMK) in AWS KMS. The encrypted data key is stored alongside the archive in the Amazon S3 object metadata. What sequence of operations must the developer implement in the application to decrypt each archive?

  1. A
    Call the AWS KMS `Decrypt` API passing the entire 18 MB18\text{ MB} encrypted archive payload directly to AWS KMS to receive the decrypted plaintext archive.
  2. Call the AWS KMS `Decrypt` API passing the encrypted data key to obtain the plaintext data key, use the plaintext data key to decrypt the archive locally, and then erase the plaintext key from memory.Answer
  3. C
    Call the AWS KMS `GenerateDataKey` API using the customer managed key to retrieve a new plaintext data key, and use this new key to decrypt the archive locally.
  4. D
    Retrieve the plaintext customer managed key directly from AWS Systems Manager Parameter Store, and use it to decrypt the archive locally.

Answer

Call the AWS KMS Decrypt API passing the encrypted data key to obtain the plaintext data key, use the plaintext data key to decrypt the archive locally, and then erase the plaintext key from memory.
The correct approach is the envelope decryption workflow. The application sends the encrypted data key to the AWS KMS `Decrypt` API. KMS decrypts it and returns the plaintext data key. The application then uses this plaintext key to decrypt the 18 MB18\text{ MB} file locally, and subsequently deletes the plaintext key from memory to minimize security risks.

Step-by-Step Solution

1
Retrieve the encrypted data key from the S3 object metadata.
The application obtains the encrypted data key needed for decryption.
The encrypted data key is required to be passed as an input to the AWS KMS Decrypt API.
2
Call the `Decrypt` API of AWS KMS, passing the encrypted data key as the CiphertextBlob parameter.
AWS KMS decrypts the key and returns the plaintext data key in the response payload.
Only AWS KMS has the primary key (CMK) necessary to decrypt the encrypted data key.
3
Use the returned plaintext data key to decrypt the 18 MB18\text{ MB} archive locally using a symmetric encryption library.
The archive is successfully decrypted to its plaintext form.
AWS KMS direct operations are limited to 4 KB4\text{ KB}; the actual payload decryption must occur client-side.
4
Erase the plaintext data key from the application memory.
The plaintext key is cleared from the RAM.
This is a critical security best practice to prevent potential memory leaks or exposure of cryptographic keys.

Key Concept

AWS KMS Envelope Decryption Workflow
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic