Examkin

Question

Difficulty: HardAWS KMS and Encryption

A developer is implementing client-side envelope encryption for a microservice that processes sensitive payload objects larger than 128 KB128\text{ KB} before storing them in an Amazon DynamoDB table. The developer needs to minimize latency, avoid KMS cryptographic limits, and ensure secure key storage.

Which of the following workflows is the correct method to encrypt and store the payloads?

  1. A
    Call `Encrypt` using the Customer Managed Key (CMK) to encrypt each payload directly, and then call `GenerateDataKeyWithoutPlaintext` to generate a secondary local data key to encrypt the metadata before storing both payloads in DynamoDB.
  2. Call `GenerateDataKey` using the Customer Managed Key (CMK) to obtain a plaintext data key and a ciphertext data key. Encrypt the payload locally using the plaintext data key, immediately delete the plaintext data key from memory, and store the ciphertext data key alongside the encrypted payload in DynamoDB.Answer
  3. C
    Call `GenerateDataKey` to obtain a data key, encrypt the payload locally, and store the plaintext data key as a secure configuration in Systems Manager Parameter Store with automatic rotation enabled to decrypt future payloads.
  4. D
    Call `GenerateDataKey` using the Customer Managed Key (CMK) to get the plaintext key, encrypt the payload, and then update the IAM Trust Policy of the microservice's execution role to allow the DynamoDB service principal to decrypt the data key directly.

Answer

Call the `GenerateDataKey` API to obtain a plaintext and ciphertext data key, encrypt the payload locally, delete the plaintext key from memory, and store the ciphertext data key with the encrypted payload in DynamoDB.
The correct workflow for client-side envelope encryption involves calling the `GenerateDataKey` API to obtain both a plaintext and a ciphertext version of a unique data key. The plaintext key is used to perform the resource-intensive encryption locally, keeping payload transit off the network and avoiding KMS API rate limits or payload size limits. The plaintext key is then deleted from memory, and the encrypted (ciphertext) data key is stored alongside the encrypted data.

Step-by-Step Solution

1
Request a data key from AWS KMS.
The `GenerateDataKey` API is called with the Customer Managed Key, returning both a plaintext data key and an encrypted (ciphertext) data key.
This provides a unique data key for symmetric encryption of the payload, ensuring envelope encryption constraints are met.
2
Encrypt the sensitive payload client-side.
The plaintext data key is used with a local cryptographic library (e.g., AES-GCM) to encrypt the payload larger than 128 KB128\text{ KB} without sending the payload to AWS KMS.
AWS KMS direct encryption APIs (`Encrypt`) have a limit of 4 KB4\text{ KB}, so client-side encryption is required for larger payloads to prevent payload limit failures.
3
Persist the encrypted data and data key, cleaning up memory.
The plaintext data key is wiped from memory, and the encrypted payload along with the ciphertext data key are saved into DynamoDB.
This ensures the plaintext key is not exposed and that future decryption is possible by calling `Decrypt` with the ciphertext data key.

Key Concept

AWS KMS Envelope Encryption
Estimated Time:2m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic