Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is building a document processing application that runs on an Amazon EC2 instance. The application needs to encrypt scanned PDF documents (each averaging 15 MB15\text{ MB} in size) before sending them to a third-party storage system. Security policy requires that the files be encrypted using client-side envelope encryption with an AWS KMS customer managed key.

Which TWO steps should the developer take to implement this encryption workflow?

  1. Call the GenerateDataKey API operation against the customer managed key to retrieve a plaintext data key and an encrypted data key.Answer
  2. Encrypt the PDF document locally using the plaintext data key, and then immediately remove the plaintext data key from memory.Answer
  3. C
    Send the PDF documents directly to the AWS KMS Encrypt API operation to perform server-side encryption.
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation to obtain the encrypted key, and decrypt it locally using a public key pair.
  5. E
    Store the generated plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter for later decryption.

Answer

To implement client-side envelope encryption for files larger than 4 KB4\text{ KB}, the developer should call GenerateDataKey to obtain a plaintext and encrypted data key, encrypt the file locally using the plaintext key, and then immediately destroy the plaintext key from memory. The encrypted data key is stored alongside the encrypted data.
The correct strategy involves calling the GenerateDataKey API operation to retrieve both a plaintext and an encrypted data key. The plaintext key is used to encrypt the 15 MB15\text{ MB} document locally, and is then immediately deleted from memory to minimize exposure. The encrypted data key is stored with the ciphertext.

Step-by-Step Solution

1
Generate the data keys using AWS KMS.
The application calls the GenerateDataKey API operation, specifying the Customer Managed Key (CMK) ID, and receives a plaintext data key and an encrypted version of the data key.
This is required to obtain a unique key for symmetric local encryption while keeping the master CMK secure inside KMS.
2
Perform local client-side encryption.
The application uses the plaintext data key to encrypt the PDF document locally using a symmetric algorithm such as AES-256.
Because the PDF size (15 MB15\text{ MB}) exceeds the 4 KB4\text{ KB} limit of direct KMS Encrypt API, the encryption must be performed client-side.
3
Secure memory and store the ciphertexts.
The plaintext data key is purged from memory, and the encrypted PDF document is stored alongside the encrypted data key.
This prevents memory exposure of the plaintext key and ensures the key can be recovered later by sending the encrypted data key back to KMS Decrypt.

Key Concept

AWS KMS client-side envelope encryption workflow
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic