Examkin

Question

Difficulty: MediumAWS KMS and Encryption

An e-commerce backend running on AWS Lambda needs to store sensitive customer profile data in an Amazon RDS database. Due to compliance requirements, the application must encrypt the profile data client-side before sending it to the database. The size of each profile is approximately 350 KB350\text{ KB}.

Which of the following steps must the developer perform in the application code to implement this client-side encryption? (Select TWO)

  1. Call the KMS GenerateDataKey API using a customer managed key to obtain a plaintext data key and an encrypted data key.Answer
  2. Encrypt the customer profile data locally using the plaintext data key, and then delete the plaintext data key from memory.Answer
  3. C
    Send the profile data directly to the KMS Encrypt API using a customer managed key.
  4. D
    Call the KMS GenerateDataKeyWithoutPlaintext API to obtain the plaintext data key and use it to encrypt the profile data locally.
  5. E
    Download the private key material of the customer managed key from AWS Systems Manager Parameter Store to encrypt the profile data locally.

Answer

Call the KMS GenerateDataKey API using a customer managed key to obtain a plaintext data key and an encrypted data key, and encrypt the customer profile data locally using the plaintext data key, and then delete the plaintext data key from memory.
For payloads larger than 4 KB, such as a 350 KB customer profile, developers must use envelope encryption. This involves calling the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the data locally in the application, and is then immediately deleted from memory for security. The encrypted data key is stored alongside the encrypted data.

Step-by-Step Solution

1
Evaluate payload size limits.
The profile data size is 350 KB. Because this exceeds the 4 KB limit of the KMS Encrypt API, client-side envelope encryption must be used.
Direct KMS encryption APIs are designed for small payloads (under 4 KB).
2
Generate data keys using KMS.
Invoke the KMS GenerateDataKey API, specifying the customer managed key. KMS returns a plaintext data key and an encrypted data key.
The plaintext key is required for local encryption, and the encrypted data key is saved to allow future decryption.
3
Perform local encryption and cleanup.
Encrypt the customer profile data locally using the plaintext data key, and then delete the plaintext data key from application memory.
Encrypting locally secures the data before database transit, and removing the plaintext key from memory protects against memory exposure.

Key Concept

AWS KMS Envelope Encryption
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic