Examkin

Question

Difficulty: EasyAWS KMS and Encryption

A developer is writing a Java application that needs to encrypt a database export file of 50 MB50\text{ MB} before uploading it to Amazon S3. The security policy requires client-side envelope encryption using an AWS KMS customer managed key. Which AWS KMS API operation should the developer use to obtain the necessary data key to encrypt this file locally?

  1. GenerateDataKeyAnswer
  2. B
    Encrypt
  3. C
    GenerateDataKeyWithoutPlaintext
  4. D
    GetParametersByPath

Answer

GenerateDataKey
The correct answer is the GenerateDataKey operation. In client-side envelope encryption, the application calls GenerateDataKey, which generates a unique symmetric data key under the specified customer managed key. KMS returns both the plaintext key (which the Java application uses to encrypt the 50 MB50\text{ MB} file locally) and the encrypted version of that same data key (which is uploaded to Amazon S3 alongside the encrypted file).

Step-by-Step Solution

1
Determine the encryption method based on file size.
Since the file size (50 MB50\text{ MB}) is much larger than the 4 KB4\text{ KB} payload limit for direct AWS KMS encryption, the developer must use client-side envelope encryption.
AWS KMS is not designed to encrypt large datasets directly.
2
Identify the KMS API required to generate a local data key.
The application needs to generate a unique data key under the specified customer managed key, receiving both the plaintext version (to perform the encryption) and the ciphertext version (to package with the encrypted file).
Envelope encryption requires a local symmetric data key to perform the actual data encryption.
3
Select the correct KMS API operation.
The GenerateDataKey operation is the standard API designed for envelope encryption workflows to return both the plaintext and encrypted data keys.
This avoids unnecessary Decrypt calls that would be required if using GenerateDataKeyWithoutPlaintext.

Key Concept

AWS KMS Envelope Encryption and Data Key Generation
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic