Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing a security strategy for an application. The application needs to retrieve a database password and also encrypt application audit logs (average size 2 MB2\text{ MB}) locally before archiving them to Amazon S3. The database password requires automatic rotation. The audit logs must be encrypted client-side using a customer managed key (KMS key) in AWS KMS. Which combination of services and KMS operations should the developer use to meet these requirements?

  1. Store the database password in AWS Secrets Manager to enable automatic rotation. For the audit logs, call GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the logs locally with the plaintext key, and store the encrypted data key alongside the encrypted logs in S3.Answer
  2. B
    Store the database password in Systems Manager Parameter Store to enable automatic rotation. For the audit logs, call Encrypt to encrypt the logs directly using the customer managed key before uploading them to S3.
  3. C
    Store the database password in AWS Secrets Manager. For the audit logs, call Decrypt to retrieve the plaintext customer managed key, encrypt the logs locally with the customer managed key, and upload them to S3.
  4. D
    Store the database password in AWS Secrets Manager. For the audit logs, call GenerateDataKeyWithoutPlaintext to obtain an encrypted data key, encrypt the logs locally using the encrypted data key, and upload them to S3.

Answer

Store the database password in AWS Secrets Manager to enable automatic rotation. For the audit logs, call GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the logs locally with the plaintext key, and store the encrypted data key alongside the encrypted logs in S3.
The correct approach uses AWS Secrets Manager for the database password because it provides out-of-the-box automatic rotation. For the audit logs, since the payload size (2 MB2\text{ MB}) exceeds the 4 KB4\text{ KB} limit of the KMS Encrypt API, the application must use envelope encryption. The GenerateDataKey API returns both the plaintext data key (used to encrypt the file locally) and the ciphertext data key (stored alongside the encrypted logs for future decryption).

Step-by-Step Solution

1
Select the appropriate secrets management service.
AWS Secrets Manager is selected because it natively supports database credential rotation, whereas Systems Manager Parameter Store does not.
Meeting the requirement for automatic rotation of the database password.
2
Determine the encryption method for the 2 MB2\text{ MB} audit logs.
The Encrypt API has a 4 KB4\text{ KB} limit, so client-side envelope encryption must be used.
Enabling the encryption of large files that exceed the KMS direct encryption payload limit.
3
Identify the correct KMS API call for envelope encryption.
GenerateDataKey is chosen because it returns the plaintext key needed for local encryption and the ciphertext key for storage.
Obtaining the necessary keys to encrypt the data locally and decrypt it later.

Key Concept

AWS KMS Envelope Encryption and Secrets Management
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic