Examkin

Question

Difficulty: HardAWS KMS and Encryption

A developer is implementing a secure audit logging system where an application running on Amazon EC2 instances encrypts log files locally before uploading them to Amazon S3. A separate analytics service running on AWS Fargate needs to decrypt and process these log files. The developer wants to use a customer managed key (CMK) in AWS KMS for envelope encryption and must ensure that all encryption and decryption operations are cryptographically bound to the encryption context `{"Project": "Audit"}`.

Which TWO actions must the developer perform to successfully implement this security architecture?

  1. In the EC2 application code, call the `GenerateDataKey` API operation using the KMS key identifier and passing the encryption context `{"Project": "Audit"}` to retrieve both the plaintext data key and the encrypted data key.Answer
  2. In the ECS task role policy of the Fargate service, grant `kms:Decrypt` permission for the CMK, and include a condition block that checks the `kms:EncryptionContext:Project` key is equal to `"Audit"`.Answer
  3. C
    In the EC2 application code, call the `Encrypt` API operation with the KMS key identifier and the encryption context `{"Project": "Audit"}` to directly encrypt each log file before upload.
  4. D
    In the EC2 application code, call the `GenerateDataKeyWithoutPlaintext` API operation with the encryption context `{"Project": "Audit"}`, then call `Decrypt` on the returned ciphertext key to get the plaintext key for local encryption.
  5. E
    In the ECS task execution role policy of the Fargate service, grant `kms:Decrypt` permission for the CMK, and append the encryption context value to the resource ARN.

Answer

In the EC2 application code, call the GenerateDataKey API operation using the KMS key identifier and passing the encryption context {"Project": "Audit"} to retrieve both the plaintext data key and the encrypted data key; and in the ECS task role policy of the Fargate service, grant kms:Decrypt permission for the CMK, and include a condition block that checks the kms:EncryptionContext:Project key is equal to "Audit".
The correct options describe the proper implementation of client-side envelope encryption and IAM policy configuration. To encrypt files of arbitrary size, the producer must generate a data key using the `GenerateDataKey` API, passing the required encryption context. This context is cryptographically bound to the data key. On the consuming side, the application running inside the Fargate container needs permissions to decrypt the data key. Since this is an application runtime activity, the permission must be granted to the Fargate Task Role (rather than the Task Execution Role). The security policy enforces the use of the correct encryption context by using a condition block checking for the `kms:EncryptionContext:Project` key.

Step-by-Step Solution

1
Generate the data key for envelope encryption
The EC2 application makes a call to `GenerateDataKey` passing the customer managed key identifier and `{"Project": "Audit"}` as the encryption context. This returns both the plaintext data key and the ciphertext data key.
Envelope encryption requires a local plaintext key to perform symmetric encryption on the file, and an encrypted copy of the key to store alongside the ciphertext.
2
Encrypt the log file locally and discard the plaintext key
The log file is encrypted with the plaintext data key. The plaintext data key is then deleted from memory, and the encrypted data key is stored as metadata with the log file in S3.
Discarding the plaintext key from memory after use ensures that only the encrypted data key remains, protecting the data at rest.
3
Configure the Fargate task permissions and policy conditions
The Fargate service's ECS task role policy is configured to allow `kms:Decrypt` on the CMK, constrained by a policy condition requiring `kms:EncryptionContext:Project` to be `"Audit"`.
The consumer service needs the task role (not the task execution role) to decrypt the data key during application runtime, and the policy condition enforces cryptographic context binding.
4
Decrypt the log file on Fargate
The Fargate consumer downloads the log and the encrypted data key, then calls `Decrypt` on the data key passing the exact encryption context `{"Project": "Audit"}`. It receives the plaintext key and decrypts the log file.
KMS will reject the decryption request if the encryption context passed to the API does not match the context used during key generation.

Key Concept

AWS KMS envelope encryption workflows, encryption context binding, and proper IAM role configuration for containerized services.
Estimated Time:2m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic