Examkin

Question

Difficulty: HardAWS KMS and Encryption

A microservice running on AWS Lambda needs to perform local client-side envelope encryption on application log files that range from 1010 MB to 5050 MB in size before storing them in an on-premises archive. The microservice must use a customer managed key in AWS KMS.

Which of the following configuration and SDK coding steps should the developer perform to implement this securely with minimum privilege? (Select TWO.)

  1. Call the `GenerateDataKey` API operation in the application code, using the plaintext data key to encrypt the log file locally, and discard the plaintext key from memory immediately after encryption.Answer
  2. Add `kms:GenerateDataKey` permissions to the Lambda function's IAM execution role for the specific ARN of the customer managed key.Answer
  3. C
    Call the `Encrypt` API operation in the application code, passing the raw log file as the plaintext parameter to be encrypted directly by KMS.
  4. D
    Call the `GenerateDataKeyWithoutPlaintext` API operation in the application code to retrieve the ciphertext data key, then use the Lambda function's default environment variables to decrypt it.
  5. E
    Grant `kms:Decrypt` and `kms:GenerateDataKey` permissions on the AWS managed key `aws/s3` to the Lambda execution role.

Answer

To implement local client-side envelope encryption for large files with minimum privilege, the developer must call `GenerateDataKey` in the application code to obtain the plaintext and ciphertext data keys, and grant `kms:GenerateDataKey` permissions on the customer managed key to the Lambda execution role.
For files larger than 44 KB, local client-side envelope encryption must be utilized. Calling the `GenerateDataKey` API operation provides the plaintext key required to encrypt the logs locally and the ciphertext key to store along with the encrypted logs. The Lambda execution role must be granted permissions to execute `kms:GenerateDataKey` on the specific customer managed key's ARN to adhere to the principle of least privilege.

Step-by-Step Solution

1
Analyze the size of the data to be encrypted (1010 MB to 5050 MB) to determine the encryption method.
Direct encryption via the KMS `Encrypt` API is ruled out due to its 40964096 bytes limit, indicating that local client-side envelope encryption is required.
Understanding KMS payload limits is necessary to select the correct encryption workflow.
2
Determine the correct KMS API operation to generate encryption keys.
The application must call `GenerateDataKey` to retrieve both the plaintext data key (for local encryption) and the ciphertext data key (for storage).
Calling `GenerateDataKeyWithoutPlaintext` would not yield the plaintext key needed to perform the encryption.
3
Configure the Lambda execution role's IAM policy for least privilege access to the KMS key.
Allow the `kms:GenerateDataKey` action on the specific ARN of the customer managed key.
Granting permissions on AWS managed keys like `aws/s3` is incorrect because the key policies cannot be modified and the resource constraint must point to the customer managed key.

Key Concept

AWS KMS Envelope Encryption Workflow and IAM Permissions
Estimated Time:2m 0s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic