Examkin

Question

Difficulty: HardAWS KMS and Encryption

A developer is implementing client-side envelope encryption to secure proprietary application log files, each approximately 8 MB8\text{ MB} in size, before archiving them to an Amazon S3 bucket. The developer wants to minimize both network latency and KMS API costs while ensuring the application principal adheres to the principle of least privilege. Which two actions must the developer perform to successfully implement the encryption phase of this workflow?

  1. Grant the application's IAM role permissions for the `kms:GenerateDataKey` action, but do not grant permissions for the `kms:Encrypt` action.Answer
  2. Call the `GenerateDataKey` API operation, encrypt the log file client-side using the returned plaintext data key, and then save both the encrypted log file and the encrypted data key to Amazon S3.Answer
  3. C
    Call the `GenerateDataKeyWithoutPlaintext` API operation to retrieve the encrypted data key, use it directly to encrypt the log file, and discard the key.
  4. D
    Grant the application's IAM role permissions for the `kms:Encrypt` action, and call the `Encrypt` API operation for each log file to secure the payload before uploading to S3.
  5. E
    Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter, using the log file's S3 object key as the parameter name.

Answer

Grant the application's IAM role permissions for the `kms:GenerateDataKey` action (excluding `kms:Encrypt`) and call the `GenerateDataKey` API operation, using the returned plaintext data key to encrypt the log file locally before saving the encrypted log and the encrypted data key to Amazon S3.
The correct configuration requires calling the `GenerateDataKey` API operation, which returns both the plaintext data key (used for local symmetric encryption of the 8 MB8\text{ MB} file) and the ciphertext data key (stored with the encrypted file in S3). Because the encryption is performed locally by the application rather than by the KMS service, the application's IAM role only requires `kms:GenerateDataKey` permission and does not need `kms:Encrypt` permission.

Step-by-Step Solution

1
Determine key size and encryption method.
Since the log files are 8 MB8\text{ MB} (which exceeds the KMS direct encryption limit of 4 KB4\text{ KB}), client-side envelope encryption must be used.
KMS direct encryption API is restricted to small payloads; envelope encryption resolves this by performing encryption locally using a data key.
2
Configure IAM permissions for the application role.
Grant `kms:GenerateDataKey` permission. Do not grant `kms:Encrypt`.
Least privilege requires only the permissions necessary to generate the data key. The encryption is done locally, so KMS `Encrypt` is not utilized.
3
Request a data key from AWS KMS.
The application calls the `GenerateDataKey` API and receives a plaintext data key and a ciphertext data key.
The plaintext key is required for local encryption, and the ciphertext key is stored for future decryption.
4
Perform local encryption and storage.
Encrypt the log file using the plaintext data key, securely wipe the plaintext key from memory, and upload both the encrypted log file and the ciphertext data key to S3.
This completes the envelope encryption workflow, ensuring plaintext keys are not exposed or persisted.

Key Concept

AWS KMS client-side envelope encryption workflow and IAM privilege separation
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic