Examkin

Question

Difficulty: MediumAWS KMS and Encryption

An application's secure ingestion service receives files and needs to prepare them for later encryption by a separate worker service running in a restricted environment. The ingestion service must generate an encrypted data key and store it alongside each file's metadata in a database. To minimize the attack surface, the security architecture requires that the ingestion service must never have access to the plaintext version of the data key. Which AWS KMS API operation should the developer call in the ingestion service to meet these requirements?

  1. GenerateDataKeyWithoutPlaintextAnswer
  2. B
    GenerateDataKey
  3. C
    Encrypt
  4. D
    GetParameter

Answer

GenerateDataKeyWithoutPlaintext
The GenerateDataKeyWithoutPlaintext operation generates a unique symmetric data key under a specified KMS key and returns only the encrypted ciphertext representation of that data key. This prevents the ingestion service from exposing or holding the plaintext data key in memory, satisfying the security policy.

Step-by-Step Solution

1
Analyze the security constraints and envelope encryption requirements.
The ingestion service needs an encrypted data key to store but must not access the plaintext data key.
This determines the specific KMS API call needed to omit the plaintext data key from the response.
2
Identify the KMS API operation that generates data keys without returning the plaintext component.
GenerateDataKeyWithoutPlaintext is identified as the operation that returns only the ciphertext data key.
Unlike GenerateDataKey, which returns both plaintext and ciphertext, GenerateDataKeyWithoutPlaintext satisfies the zero-plaintext exposure constraint.

Key Concept

AWS KMS Envelope Encryption API operations
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic