Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is building an application that must encrypt raw sensor data files, each approximately 20 MB20\text{ MB} in size, locally on an application server before uploading them to a third-party storage system. The developer wants to use envelope encryption with a customer managed AWS KMS key. Which two steps must the developer perform to implement this encryption process?

  1. Call the GenerateDataKey API operation using the customer managed KMS key to obtain a plaintext data key and an encrypted copy of the data key.Answer
  2. Encrypt the sensor data locally using the plaintext data key, and then delete the plaintext data key from memory.Answer
  3. C
    Call the KMS Encrypt API operation directly to encrypt each sensor data file.
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation, and decrypt the returned ciphertext using the public certificate of the KMS key.
  5. E
    Store the plaintext data key as a SecureString parameter in AWS Systems Manager Parameter Store to use for subsequent decryption operations.

Answer

To implement envelope encryption for files larger than 4 KB4\text{ KB}, the developer must call the GenerateDataKey API to obtain both a plaintext and an encrypted data key, encrypt the data locally using the plaintext data key, and then immediately destroy the plaintext key from memory.
The correct steps for envelope encryption involve calling the GenerateDataKey API operation to retrieve a plaintext data key and an encrypted version of that key. The application then uses the plaintext data key to perform local symmetric encryption of the payload, and finally deletes the plaintext key from memory. The encrypted data key is saved alongside the encrypted data so that it can be decrypted by KMS later.

Step-by-Step Solution

1
Invoke the KMS GenerateDataKey API.
The API returns a plaintext version of the data key and a ciphertext version encrypted under the customer managed KMS key.
Because the files are 20 MB20\text{ MB} in size, they exceed the direct KMS encryption limit of 4 KB4\text{ KB}, requiring local envelope encryption.
2
Encrypt the raw sensor data locally using a symmetric encryption algorithm and the plaintext data key.
The file is encrypted to a ciphertext payload.
Performing encryption locally offloads the cryptographic workload from KMS to the application server.
3
Discard the plaintext data key from application memory, and store the encrypted data key alongside the encrypted payload.
Only the encrypted data key and the encrypted payload remain.
Retaining the plaintext key in memory increases security risks. The encrypted data key is safe to store next to the encrypted file and will be used during decryption.

Key Concept

Envelope encryption is the practice of encrypting plaintext data with a data key, and then encrypting the data key under another key (the KMS root key). It is required for encrypting data payloads larger than 4 KB4\text{ KB} using AWS KMS.
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic