A developer needs to encrypt a database backup file of size on an application server before uploading it to Amazon S3. The developer decides to use client-side envelope encryption with an AWS KMS customer managed key.
Which two actions must the developer perform to encrypt the file locally?
- Call the GenerateDataKey API operation to receive both a plaintext data key and an encrypted data key.Answer
- Encrypt the file locally with the plaintext data key, and then securely discard the plaintext key from memory.Answer
- CCall the KMS Encrypt API operation directly to encrypt the entire file.
- DCall the GenerateDataKeyWithoutPlaintext API operation to get the encrypted key, and then decrypt it using an SSL certificate.
- EStore the database backup file directly in Systems Manager Parameter Store to automatically encrypt it with a secure string parameter.
Answer
The developer must call the GenerateDataKey API to obtain the data keys, encrypt the file locally with the plaintext data key, and then securely remove the plaintext data key from memory.
To perform envelope encryption, the application calls the GenerateDataKey API, which returns a plaintext data key and an encrypted version of that same key. The developer uses the plaintext data key to encrypt the large file locally. Once encrypted, the plaintext data key is discarded from memory, and the encrypted data key is stored alongside the ciphertext file so it can be decrypted later.
Step-by-Step Solution
Key Concept
AWS KMS Envelope Encryption Workflow