Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing client-side envelope encryption in a custom application to encrypt large payload files (greater than 10 MB10\text{ MB}) before uploading them to Amazon S3. The application needs to perform the encryption locally using a customer managed key stored in AWS KMS.

Which sequence of AWS SDK operations should the developer use to perform this client-side encryption?

  1. Call GenerateDataKey to retrieve both a plaintext and a ciphertext version of a data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the ciphertext key with the encrypted payload.Answer
  2. B
    Call Encrypt with the payload data to perform direct encryption in AWS KMS, then store the returned ciphertext payload in Amazon S3.
  3. C
    Call GenerateDataKeyWithoutPlaintext to retrieve the ciphertext data key. Use the ciphertext key to encrypt the payload locally, then store both the encrypted payload and the ciphertext key.
  4. D
    Call GetParameter with decryption enabled to retrieve the customer managed key from AWS Systems Manager Parameter Store, then use it to encrypt the payload locally.

Answer

Call GenerateDataKey to retrieve both a plaintext and a ciphertext version of a data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the ciphertext key with the encrypted payload.
The correct approach is to call the GenerateDataKey API to obtain both a plaintext data key (for local cryptographic operations) and a ciphertext data key (for safe storage). The plaintext key is used to encrypt the payload locally and must be removed from memory immediately afterward to ensure security.

Step-by-Step Solution

1
Request a data key from AWS KMS.
Call the GenerateDataKey API passing the identifier of the customer managed key, which returns both a plaintext data key and a ciphertext data key.
The application needs the plaintext key to perform the local cryptographic operation, and the ciphertext key to store with the data for future decryption.
2
Perform local encryption.
Encrypt the 10 MB10\text{ MB} payload locally using the plaintext data key and a local encryption algorithm (e.g., AES-256).
Encrypting the data locally avoids sending large payloads over the network to AWS KMS, which has a strict 4 KB4\text{ KB} limit for direct encryption.
3
Clean up memory and persist metadata.
Wipe the plaintext data key from memory and upload the encrypted payload along with the ciphertext data key to Amazon S3.
Discarding the plaintext key ensures security, while saving the ciphertext key ensures that the data can be decrypted later by calling the Decrypt API with KMS.

Key Concept

AWS KMS Envelope Encryption Workflow
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic