Examkin

Question

Difficulty: HardAWS KMS and Encryption

A developer is writing a backup utility that must encrypt database export files, each approximately 500 MB500\text{ MB} in size, before uploading them to an Amazon S3 bucket. The utility must use client-side envelope encryption with an AWS Key Management Service (AWS KMS) customer managed key.

Which two steps must the developer implement in the utility's code to encrypt the files securely and prepare them for storage?

  1. Call the AWS KMS GenerateDataKey API operation by passing the customer managed key identifier to obtain both a plaintext data key and a ciphertext data key.Answer
  2. Encrypt the database export file locally using the plaintext data key with a symmetric encryption algorithm, and then delete the plaintext data key from memory.Answer
  3. C
    Call the AWS KMS Encrypt API operation by passing the database export file and the customer managed key identifier to obtain the encrypted ciphertext.
  4. D
    Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation to obtain the encrypted data key, and then call the AWS KMS Decrypt API operation to retrieve the plaintext data key.
  5. E
    Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter, and upload the encrypted database export file to the S3 bucket.

Answer

Call the AWS KMS GenerateDataKey API operation by passing the customer managed key identifier to obtain both a plaintext data key and a ciphertext data key, and encrypt the database export file locally using the plaintext data key with a symmetric encryption algorithm, and then delete the plaintext data key from memory.
The correct answer combines calling the AWS KMS GenerateDataKey API to retrieve both key formats and performing the symmetric encryption locally before deleting the plaintext key from memory. Since the database export file is 500 MB500\text{ MB}, direct encryption via the AWS KMS Encrypt API is impossible due to its 4 KB4\text{ KB} payload limit. Locally encrypting with the plaintext data key and then immediately destroying it ensures maximum security.

Step-by-Step Solution

1
Generate a unique data key pair using AWS KMS.
Obtained a plaintext data key and a ciphertext data key via the GenerateDataKey API call.
The file size (500 MB500\text{ MB}) exceeds the direct encryption payload limit of 4 KB4\text{ KB} for AWS KMS, so envelope encryption must be initiated.
2
Encrypt the file locally.
The file is encrypted using a symmetric cipher (such as AES-GCM) with the plaintext data key.
Envelope encryption requires the actual data to be encrypted client-side using the generated plaintext data key.
3
Secure the encryption keys.
The plaintext data key is discarded from memory, and the ciphertext data key is saved for future decryption.
This prevents exposure of the plaintext key and allows future decryption by sending the ciphertext data key back to AWS KMS.

Key Concept

AWS KMS client-side envelope encryption workflow and payload limits
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic