Examkin

Question

Difficulty: EasyAWS KMS and Encryption

A developer needs to encrypt local application backup files before uploading them to Amazon S3 using client-side envelope encryption with an AWS KMS customer managed key. Which TWO actions must the developer perform to complete this encryption process? (Select TWO.)

  1. Call the GenerateDataKey API operation to retrieve both a plaintext and a ciphertext version of the data key.Answer
  2. Encrypt the files locally using the plaintext data key, and then delete the plaintext data key from memory.Answer
  3. C
    Call the KMS Encrypt API operation directly for each file to encrypt the payload on the server side.
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation and use the returned ciphertext data key to encrypt the files.
  5. E
    Store the plaintext data key in AWS Systems Manager Parameter Store to use during future decryption processes.

Answer

To perform local envelope encryption, the developer must call the GenerateDataKey API to obtain a plaintext and ciphertext data key, encrypt the files locally using the plaintext key, and then delete the plaintext key from memory.
In client-side envelope encryption, the client must obtain a data key from KMS by calling the GenerateDataKey API. The API returns both a plaintext data key and a ciphertext data key. The developer uses the plaintext data key to encrypt the files locally and then immediately deletes the plaintext key from memory to prevent unauthorized access. The ciphertext data key is stored next to the encrypted file so it can be decrypted later when needed.

Step-by-Step Solution

1
Request a data key from AWS KMS
Obtained a plaintext data key and a ciphertext data key by invoking the GenerateDataKey API with the customer managed key.
The plaintext key is necessary for local encryption, while the ciphertext key is stored alongside the data for subsequent decryption.
2
Encrypt the file locally
Encrypted the backup files using the plaintext data key with a local cryptographic library.
This performs client-side encryption without sending the file payload to AWS KMS.
3
Clean up the memory
Deleted the plaintext data key from memory and retained the ciphertext data key.
Ensures the plaintext key does not persist in memory, which would compromise the security of the encrypted files.

Key Concept

AWS KMS Client-Side Envelope Encryption Workflow
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic