Examkin

Question

Difficulty: EasyAWS KMS and Encryption

A developer needs to secure a database connection string containing credentials. The string is 2 KB2\text{ KB} in size, and the developer wants to perform direct server-side encryption using an AWS KMS customer managed key without generating and managing local data keys. Which AWS KMS API operation should the developer call to encrypt this payload directly?

  1. A
    GenerateDataKey
  2. B
    GenerateDataKeyWithoutPlaintext
  3. EncryptAnswer
  4. D
    PutParameter

Answer

The correct answer is the Encrypt API operation, which allows direct encryption of small payloads up to 4 KB4\text{ KB}.
The Encrypt API operation in AWS KMS is designed to directly encrypt small payloads up to 4 KB4\text{ KB} using a specified KMS key. Since the database connection string is only 2 KB2\text{ KB} in size, the developer can send the plaintext directly to AWS KMS for encryption without the overhead of generating, managing, and storing local data keys.

Step-by-Step Solution

1
Analyze the payload size and the requirement to avoid local data key management.
The database connection string is 2 KB2\text{ KB} in size, and direct encryption is preferred over envelope encryption.
This determines if direct encryption is possible and matches the developer's preference.
2
Check the maximum payload limit for the AWS KMS Encrypt API.
The Encrypt API supports direct encryption of data payloads up to 4 KB4\text{ KB}.
To verify that the 2 KB2\text{ KB} payload is within the direct encryption threshold.
3
Identify the KMS API operation that performs direct encryption on the payload.
The Encrypt operation takes the plaintext payload and returns the ciphertext directly.
To select the operation that meets all requirements without introducing envelope encryption complexity.

Key Concept

AWS KMS Direct Encryption Limits
Estimated Time:45s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic