Examkin

Question

Difficulty: HardAWS KMS and Encryption

A developer is building a client-side utility in Python using the Boto3 SDK to encrypt database export files, each averaging 45 MB45\text{ MB} in size, before archiving them to an Amazon S3 bucket. The compliance policy requires the use of client-side envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS. Which of the following SDK workflows represents the correct and most efficient implementation for encrypting each file?

  1. Call the KMS `generate_data_key` API to retrieve both a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, immediately delete the plaintext data key from memory, and store the encrypted file alongside the encrypted data key.Answer
  2. B
    Call the KMS `generate_data_key_without_plaintext` API to retrieve the encrypted data key. Use the encrypted data key to encrypt the file locally, and store the encrypted file along with the encrypted data key.
  3. C
    Divide the file into chunks smaller than 4 KB4\text{ KB} each. For each chunk, call the KMS `encrypt` API directly using the Customer Managed Key, concatenate the ciphertexts, and upload the final consolidated file.
  4. D
    Call the Systems Manager Parameter Store to retrieve the plaintext key material of the Customer Managed Key. Use this key material to encrypt the file locally, and upload the encrypted file.

Answer

Call the KMS `generate_data_key` API to retrieve both a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, immediately delete the plaintext data key from memory, and store the encrypted file alongside the encrypted data key.
The correct implementation is to call the KMS `generate_data_key` API using the Customer Managed Key ID. KMS returns both the plaintext data key and the ciphertext (encrypted) data key. The application uses the plaintext key to encrypt the large file locally (client-side) using an algorithm like AES-256, deletes the plaintext key from memory to maintain security, and stores the encrypted data key alongside the encrypted file (often as S3 metadata) so it can be sent to KMS for decryption later.

Step-by-Step Solution

1
Request a data key from AWS KMS.
Receive a payload containing both the plaintext data key and the encrypted version of that key.
The plaintext key is required for local encryption, and the encrypted key is required for future decryption.
2
Encrypt the file locally using a symmetric encryption algorithm (e.g., AES-256) with the plaintext data key.
Generate the encrypted file payload.
Using the data key allows the encryption to happen locally, avoiding the 4 KB4\text{ KB} limit of KMS direct encryption.
3
Secure the keys by deleting the plaintext data key from memory and keeping the encrypted data key.
The plaintext key is discarded, and the encrypted data key is kept.
Leaving the plaintext key in memory or writing it to disk is a security risk. The encrypted data key can only be decrypted by KMS.
4
Upload the encrypted file and the encrypted data key together to Amazon S3.
The ciphertext and metadata are stored in S3.
When decrypting, the client will retrieve the encrypted data key from S3 and pass it to KMS to get the plaintext key back.

Key Concept

AWS KMS Client-Side Envelope Encryption Workflow
Estimated Time:2m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic