Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer needs to secure a configuration file containing sensitive application credentials that is 15 KB15\text{ KB} in size. The developer wants to implement client-side encryption using a customer managed key in AWS Key Management Service (AWS KMS) before storing the file.

Which approach should the developer take to encrypt this file?

  1. Call the KMS GenerateDataKey API to retrieve a plaintext data key and an encrypted data key. Encrypt the configuration file locally using the plaintext data key, then delete the plaintext key from memory and store the encrypted configuration file with the encrypted data key.Answer
  2. B
    Call the KMS Encrypt API directly, passing the 15 KB15\text{ KB} configuration file as the plaintext payload, and store the resulting ciphertext in the application storage.
  3. C
    Call the KMS GenerateDataKeyWithoutPlaintext API to receive an encrypted data key. Decrypt the data key using the KMS Decrypt API, encrypt the configuration file locally, and then discard the plaintext data key.
  4. D
    Store the configuration file as a secret in AWS Secrets Manager, and configure AWS Systems Manager Parameter Store to perform client-side envelope decryption of the secret values.

Answer

Call the KMS GenerateDataKey API to retrieve a plaintext data key and an encrypted data key. Encrypt the configuration file locally using the plaintext data key, then delete the plaintext key from memory and store the encrypted configuration file with the encrypted data key.
The configuration file is 15 KB15\text{ KB}, which exceeds the 4 KB4\text{ KB} limit for direct encryption using the AWS KMS `Encrypt` API. Therefore, client-side envelope encryption is required. Calling `GenerateDataKey` provides both the plaintext data key to perform the local encryption and the encrypted data key to be stored alongside the ciphertext for future decryption.

Step-by-Step Solution

1
Determine the file size and verify AWS KMS limits.
The file is 15 KB15\text{ KB}, which exceeds the 4 KB4\text{ KB} limit for direct encryption via the KMS `Encrypt` API.
To choose the correct API, the developer must recognize that envelope encryption is required due to the payload size.
2
Generate a data key using AWS KMS.
The developer calls `GenerateDataKey`, receiving a plaintext data key and an encrypted version of it.
The plaintext key is required for local encryption, and the encrypted key is required for future decryption.
3
Encrypt the data locally and clean up memory.
The file is encrypted with the plaintext data key. The plaintext data key is then deleted from memory to maintain security.
Keeping the plaintext key in memory increases the security risk of key exposure.

Key Concept

AWS KMS Envelope Encryption Workflow
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic