Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing client-side decryption in an application. The application receives a data package containing a 5 MB5\text{ MB} ciphertext payload and an encrypted data key that was originally generated using an AWS KMS customer managed key. The application has the necessary IAM permissions to access the customer managed key.

Which sequence of steps must the developer perform in the application code to decrypt the payload?

  1. A
    Call the KMS GenerateDataKey API using the customer managed key to obtain the plaintext data key, decrypt the payload locally using this key, and then discard the new encrypted data key.
  2. B
    Submit the entire ciphertext payload directly to the KMS Decrypt API, allowing AWS KMS to automatically locate the customer managed key, decrypt the payload, and return the plaintext data.
  3. Send the encrypted data key to the KMS Decrypt API to retrieve the plaintext data key, decrypt the ciphertext payload locally using the plaintext data key, and then delete the plaintext data key from memory.Answer
  4. D
    Retrieve the plaintext data key from Systems Manager Parameter Store using the GetParameter API with the customer managed key's ARN, decrypt the payload locally, and store the decrypted data back in Parameter Store as a SecureString.

Answer

The correct sequence is to send the encrypted data key to the KMS Decrypt API to retrieve the plaintext data key, decrypt the ciphertext payload locally using the plaintext data key, and then delete the plaintext data key from memory.
The correct sequence matches the standard client-side envelope decryption workflow. The application sends the encrypted data key (which is small enough to fit within KMS API limits) to the KMS Decrypt API. KMS uses the customer managed key to decrypt it and returns the plaintext data key. The application then performs local decryption on the 5 MB5\text{ MB} payload and safely removes the plaintext key from memory.

Step-by-Step Solution

1
Send the encrypted data key to the AWS KMS Decrypt API.
The API returns the plaintext data key.
To perform client-side decryption, the application first needs the raw plaintext data key.
2
Decrypt the ciphertext payload locally using the retrieved plaintext data key.
The 5 MB5\text{ MB} payload is decrypted into its original plaintext format.
Because KMS has a 4 KB4\text{ KB} API limit, decryption must be handled locally by the application using cryptographic libraries.
3
Delete the plaintext data key from the application memory.
The plaintext data key is removed from memory.
Leaving the plaintext key in memory exposes it to potential security risks.

Key Concept

AWS KMS Envelope Decryption
Rate this question