An application running on AWS Fargate needs to encrypt sensitive PDF contract files (each approximately in size) before storing them in an Amazon Elastic File System (Amazon EFS) volume. The application must use envelope encryption with a customer managed key in AWS KMS.
Which two actions should a developer implement to meet these requirements? (Select TWO.)
- Call the GenerateDataKey API operation of AWS KMS using the customer managed key to obtain a plaintext data key and an encrypted data key.Answer
- Encrypt the PDF files locally with the plaintext data key, store the encrypted data key alongside the encrypted PDF files on Amazon EFS, and immediately delete the plaintext data key from memory.Answer
- CCall the Encrypt API operation of AWS KMS with the customer managed key, passing the entire PDF file payload directly to return the encrypted ciphertext.
- DCall the GenerateDataKeyWithoutPlaintext API operation of AWS KMS to retrieve only the encrypted data key, and decrypt it locally using an SSL certificate.
- EStore the PDF files as secure parameters in AWS Systems Manager Parameter Store using a SecureString parameter type encrypted with the customer managed key.
Answer
Call the GenerateDataKey API operation of AWS KMS using the customer managed key to obtain a plaintext data key and an encrypted data key, and encrypt the PDF files locally with the plaintext data key, store the encrypted data key alongside the encrypted PDF files on Amazon EFS, and immediately delete the plaintext data key from memory.
To encrypt payloads larger than , envelope encryption is required. The developer calls the `GenerateDataKey` API operation, which returns a plaintext data key and an encrypted data key. The application encrypts the PDF locally using the plaintext key, stores the encrypted data key alongside the ciphertext on Amazon EFS, and discards the plaintext data key from memory.
Step-by-Step Solution
Key Concept
AWS KMS envelope encryption workflow for objects larger than
Estimated Time:1m 30s