Examkin

Question

Difficulty: HardAWS KMS and Encryption

A developer is deploying a microservice on Amazon ECS that processes sensitive configurations. A configuration file of size 150 KB150\text{ KB} is encrypted client-side using envelope encryption with an AWS KMS customer managed key (CMK). During deployment, the application container fails to start because it cannot decrypt the configuration file.

The current configuration is as follows:
- The `kms:Decrypt` permission is granted to the ECS task execution role.
- The application code attempts to decrypt the entire configuration file by calling the `kms:Decrypt` API directly with the encrypted file content.

Which combination of actions will resolve the decryption failure and allow the application to start up successfully?

  1. Associate the `kms:Decrypt` permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the `kms:Decrypt` API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.Answer
  2. B
    Associate the `kms:Decrypt` permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass the entire encrypted configuration file to the `kms:Decrypt` API, and ensure that the payload size does not exceed the 40 MB40\text{ MB} payload limit of the API.
  3. C
    Retain the `kms:Decrypt` permission on the ECS Task Execution Role. Update the application code to call the `kms:Decrypt` API with the encrypted data key to retrieve the plaintext data key, and then decrypt the configuration file locally using the plaintext data key.
  4. D
    Retain the `kms:Decrypt` permission on the ECS Task Execution Role. Configure the application to use the Systems Manager Parameter Store to retrieve the plaintext KMS customer managed key at runtime, and decrypt the configuration file locally.

Answer

Associate the kms:Decrypt permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the kms:Decrypt API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.
The correct answer correctly identifies that application code running inside an ECS container must use the ECS Task Role for runtime authorization to call KMS APIs. Additionally, in envelope encryption, the actual payload is encrypted locally with a data key, and only the encrypted data key is sent to AWS KMS for decryption. This bypasses the 4 KB4\text{ KB} payload size limit of the `kms:Decrypt` API.

Step-by-Step Solution

1
Identify the correct IAM role for containerized application execution.
Determine that the ECS Task Role must be configured with `kms:Decrypt` permissions rather than the ECS Task Execution Role.
The ECS Task Execution Role is used by the ECS agent, not the application itself. The ECS Task Role is required for the application container to access AWS services at runtime.
2
Identify the limitations of the KMS Decrypt API.
Determine that the configuration file size of 150 KB150\text{ KB} exceeds the 4 KB4\text{ KB} size limit of the `kms:Decrypt` API.
Direct decryption using KMS is limited to small payloads under 4 KB4\text{ KB}, necessitating envelope encryption.
3
Apply the correct envelope decryption workflow.
Update the code to send only the encrypted data key to KMS, receive the plaintext data key, and decrypt the file locally.
This is the standard envelope encryption pattern, which avoids sending large payloads over the network and bypasses API limits.

Key Concept

AWS KMS Envelope Decryption and ECS IAM Roles
Estimated Time:2m 0s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic