Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing client-side envelope encryption in a containerized microservice to encrypt application configuration payloads that are approximately 2 MB2\text{ MB} in size. The developer wants to use an AWS KMS customer managed key for this process. Which of the following actions must the developer perform to encrypt the payloads? (Select two.)

  1. Call the KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key.Answer
  2. Encrypt the configuration payload locally using the plaintext data key, and then discard the plaintext data key from memory.Answer
  3. C
    Call the KMS Encrypt API operation directly using the customer managed key to encrypt the payload.
  4. D
    Call the KMS GenerateDataKeyWithoutPlaintext API operation to obtain the encrypted data key and use it to encrypt the payload locally.
  5. E
    Retrieve the plaintext data key from the AWS Systems Manager Parameter Store before executing the local encryption.

Answer

The developer must call the KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key, encrypt the payload locally using the plaintext data key, and then discard the plaintext data key from memory.
To perform client-side envelope encryption on payloads larger than 4 KB4\text{ KB}, the developer must first call GenerateDataKey to get both the plaintext data key (used for local encryption) and the encrypted data key (stored with the ciphertext). The developer then encrypts the payload locally using the plaintext data key and discards the plaintext data key from memory to maintain security.

Step-by-Step Solution

1
Request a data key from AWS KMS.
The application receives a plaintext data key and an encrypted copy of the data key.
The KMS customer managed key cannot directly encrypt payloads larger than 4 KB4\text{ KB}, so a data key is generated for local envelope encryption.
2
Encrypt the payload locally.
The payload is encrypted into ciphertext using the plaintext data key.
Local encryption using the plaintext data key is performed outside of AWS KMS to support large payloads.
3
Clean up the memory.
The plaintext data key is removed from application memory.
Discarding the plaintext key prevents unauthorized memory inspection from exposing the encryption key.

Key Concept

Client-side envelope encryption workflow with AWS KMS
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic