Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is designing a serverless document management system where users upload sensitive documents of approximately 500 KB500\text{ KB} each. The application must perform client-side envelope encryption on these documents before uploading them to an Amazon S3 bucket. The developer wants to use an AWS KMS customer managed key for this process.

Which of the following actions must the developer perform to encrypt the documents and prepare them for storage? (Select TWO.)

  1. Call the KMS `GenerateDataKey` API with the customer managed key to retrieve a plaintext data key and a ciphertext data key.Answer
  2. Encrypt the document locally using the plaintext data key, upload the encrypted document and the ciphertext data key to Amazon S3, and delete the plaintext data key from memory.Answer
  3. C
    Call the KMS `Encrypt` API directly to encrypt the document payload, as customer managed keys support direct payload encryption up to 5 MB5\text{ MB}.
  4. D
    Call the KMS `GenerateDataKeyWithoutPlaintext` API to retrieve the ciphertext data key, and use it to encrypt the document locally before uploading it to Amazon S3.
  5. E
    Store the encrypted document in Amazon S3, and save the plaintext data key in AWS Systems Manager Parameter Store with secure string parameters for future decryption.

Answer

To perform client-side envelope encryption, the developer must call the KMS GenerateDataKey API to obtain both the plaintext and ciphertext data keys. The document is encrypted locally using the plaintext data key, and both the encrypted document and ciphertext data key are stored in S3, while the plaintext data key is discarded from memory.
To implement client-side envelope encryption, the developer needs to generate a unique data key using the customer managed key. The KMS GenerateDataKey API returns both the plaintext data key (for immediate encryption) and the ciphertext data key (for storage). The document is encrypted locally using the plaintext key. After encryption, the encrypted document and ciphertext data key are uploaded to S3, and the plaintext data key is discarded from memory to prevent unauthorized access.

Step-by-Step Solution

1
Generate a data key from AWS KMS.
A plaintext data key and a ciphertext data key are obtained using the GenerateDataKey API and the customer managed key.
The plaintext data key is needed for local encryption, and the ciphertext data key is needed to decrypt the document later.
2
Perform local client-side encryption.
The document payload is encrypted using the plaintext data key.
Local encryption keeps the plaintext data secure before it is transmitted to S3.
3
Store the encrypted artifacts and clean up memory.
The encrypted document and ciphertext data key are uploaded to S3, and the plaintext data key is removed from memory.
Storing the ciphertext data key alongside the document ensures it can be decrypted later by calling KMS Decrypt, while discarding the plaintext key minimizes exposure risk.

Key Concept

AWS KMS Envelope Encryption Workflow
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic