Examkin

Question

Difficulty: HardAWS KMS and Encryption

A developer is building a serverless order processing system using AWS Lambda and Amazon DynamoDB. The system must encrypt order payloads (each approximately 15 KB15\text{ KB}) prior to saving them to DynamoDB. The developer implements envelope encryption using an AWS KMS customer managed key.

During order creation, the Lambda function calls the `GenerateDataKey` API operation, providing an `EncryptionContext` containing `{"OrderID": "ord-8831", "CustomerID": "cust-4402"}`. The application encrypts the order payload using the returned plaintext data key, discards the plaintext key, and saves the ciphertext order payload and the encrypted data key in DynamoDB.

When retrieving and decrypting the order, which approach must the Lambda function use to successfully obtain the plaintext order payload?

  1. A
    Call the KMS `Decrypt` API operation passing the ciphertext order payload and the `EncryptionContext` map directly to retrieve the decrypted order payload.
  2. B
    Call the Systems Manager Parameter Store `GetParameter` API operation, passing the OrderID to retrieve the cached plaintext data key associated with the encryption context.
  3. Call the KMS `Decrypt` API operation passing the encrypted data key and the exact same `EncryptionContext` map, then use the returned plaintext data key to decrypt the order payload locally.Answer
  4. D
    Call the KMS `Decrypt` API operation passing only the encrypted data key. The encryption context is metadata stored within the encrypted data key and is validated automatically by AWS KMS without requiring client input.

Answer

The Lambda function must call the KMS `Decrypt` API operation passing the encrypted data key and the exact same `EncryptionContext` map, then use the returned plaintext data key to decrypt the order payload locally.
The correct answer correctly identifies the envelope decryption process: calling the KMS `Decrypt` API with the encrypted data key and the exact same `EncryptionContext` map. The encryption context is cryptographically bound to the ciphertext, so supplying the exact matching key-value pairs is necessary for AWS KMS to successfully authenticate and decrypt the data key. Once the plaintext data key is returned, the client performs the actual payload decryption locally.

Step-by-Step Solution

1
Retrieve the encrypted data key and the ciphertext order payload from DynamoDB.
The Lambda function has the encrypted data key and the encrypted payload.
These components are required for the decryption process.
2
Call the AWS KMS `Decrypt` API, passing the encrypted data key and the exact encryption context `{"OrderID": "ord-8831", "CustomerID": "cust-4402"}`.
AWS KMS decrypts the data key and returns the plaintext data key.
Since the encryption context was provided during key generation, the same context is required to decrypt the key.
3
Use the plaintext data key to decrypt the 15 KB15\text{ KB} order payload locally using symmetric decryption.
The plaintext order payload is obtained.
Envelope encryption requires the actual data decryption to happen on the client side using the decrypted data key.

Key Concept

AWS KMS Envelope Decryption with Encryption Context
Estimated Time:2m 0s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic