Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is writing a backend service that needs to encrypt a sensitive JSON configuration payload of 3 KB3\text{ KB} before writing it to an Amazon DynamoDB table. The encryption must be performed client-side using AWS KMS, minimizing latency and the number of AWS API calls.

Which approach meets these requirements most efficiently?

  1. A
    Call the KMS GenerateDataKey API to retrieve a data key, encrypt the JSON payload locally using the plaintext key, and store the encrypted data key along with the ciphertext in the DynamoDB table.
  2. Call the KMS Encrypt API directly using a customer managed key, and store the resulting ciphertext in the DynamoDB table.Answer
  3. C
    Call the KMS GenerateDataKeyWithoutPlaintext API to obtain an encrypted data key, call the Decrypt API to retrieve the plaintext key, encrypt the JSON payload locally, and store it in the DynamoDB table.
  4. D
    Store the JSON configuration payload in AWS Secrets Manager as a secret, configure automatic rotation, and retrieve the secret using a DynamoDB stream trigger on every write operation.

Answer

Call the KMS Encrypt API directly using a customer managed key, and store the resulting ciphertext in the DynamoDB table.
The correct option is to call the KMS Encrypt API directly because the payload size (3 KB3\text{ KB}) is less than the 4 KB4\text{ KB} limit for direct KMS encryption. This approach minimizes latency by requiring only one API call and removes the complexity of managing envelope encryption keys locally.

Step-by-Step Solution

1
Determine the size of the payload to be encrypted.
The JSON payload is 3 KB3\text{ KB} (30723072 bytes).
AWS KMS limits direct encryption via the Encrypt API to a maximum of 4 KB4\text{ KB} (40964096 bytes).
2
Select the appropriate KMS API strategy.
Since 3 KB<4 KB3\text{ KB} < 4\text{ KB}, the payload can be encrypted directly using the Encrypt API rather than employing envelope encryption.
Direct encryption requires only a single API call and removes the operational overhead of managing data keys client-side.
3
Execute the encryption and store the output.
Send the plaintext payload to the KMS Encrypt API, receive the ciphertext, and store it in DynamoDB.
This achieves client-side encryption with minimum latency and complexity.

Key Concept

AWS KMS direct encryption capability and its 4 KB4\text{ KB} payload limit.
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic