A developer is implementing client-side decryption in an application. The application receives a data package containing a ciphertext payload and an encrypted data key that was originally generated using an AWS KMS customer managed key. The application has the necessary IAM permissions to access the customer managed key.
Which sequence of steps must the developer perform in the application code to decrypt the payload?
- ACall the KMS GenerateDataKey API using the customer managed key to obtain the plaintext data key, decrypt the payload locally using this key, and then discard the new encrypted data key.
- BSubmit the entire ciphertext payload directly to the KMS Decrypt API, allowing AWS KMS to automatically locate the customer managed key, decrypt the payload, and return the plaintext data.
- Send the encrypted data key to the KMS Decrypt API to retrieve the plaintext data key, decrypt the ciphertext payload locally using the plaintext data key, and then delete the plaintext data key from memory.Answer
- DRetrieve the plaintext data key from Systems Manager Parameter Store using the GetParameter API with the customer managed key's ARN, decrypt the payload locally, and store the decrypted data back in Parameter Store as a SecureString.
Answer
The correct sequence is to send the encrypted data key to the KMS Decrypt API to retrieve the plaintext data key, decrypt the ciphertext payload locally using the plaintext data key, and then delete the plaintext data key from memory.
The correct sequence matches the standard client-side envelope decryption workflow. The application sends the encrypted data key (which is small enough to fit within KMS API limits) to the KMS Decrypt API. KMS uses the customer managed key to decrypt it and returns the plaintext data key. The application then performs local decryption on the payload and safely removes the plaintext key from memory.
Step-by-Step Solution
Key Concept
AWS KMS Envelope Decryption