Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing client-side encryption for an application that processes large database backups with an average size of 1515 GB before uploading them to an Amazon S3 bucket. To comply with corporate security policies, the developer must use AWS KMS and envelope encryption. Which sequence of operations should the developer implement to encrypt the backup files?

  1. A
    Retrieve a symmetric encryption key from AWS Secrets Manager using the GetSecretValue API, encrypt the database backup locally using this key, and upload the encrypted backup along with the secret version ID.
  2. Call the GenerateDataKey API operation on AWS KMS to receive a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the database backup locally, erase the plaintext key from memory, and upload the encrypted backup along with the encrypted data key.Answer
  3. C
    Call the Encrypt API operation on AWS KMS directly, passing the database backup as the plaintext parameter, and upload the resulting ciphertext to the Amazon S3 bucket.
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation on AWS KMS to obtain an encrypted data key, use the encrypted data key to encrypt the database backup locally, and upload the encrypted backup.

Answer

Call the GenerateDataKey API operation on AWS KMS to receive a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the database backup locally, erase the plaintext key from memory, and upload the encrypted backup along with the encrypted data key.
The correct approach uses the GenerateDataKey API to obtain both a plaintext key (used for local encryption of the 15 GB file) and an encrypted data key (saved alongside the encrypted file). Discarding the plaintext key from memory after use adheres to the principle of least privilege and prevents memory scraping attacks.

Step-by-Step Solution

1
Request a data key from AWS KMS.
The application calls the GenerateDataKey API, receiving a plaintext data key and an encrypted data key.
This initiates the envelope encryption process by obtaining the required cryptographic keys.
2
Perform local encryption using the plaintext key.
The database backup is encrypted locally on the application server.
Because the database backup is 15 GB, it exceeds the 4 KB limit of the KMS Encrypt API and must be encrypted locally.
3
Clean up memory and upload artifacts.
The plaintext key is deleted from the application memory, and the encrypted backup file and the encrypted data key are uploaded to the S3 bucket.
Erasing the plaintext key from memory minimizes the risk of key exposure. The encrypted data key can be decrypted by KMS later when the backup needs to be restored.

Key Concept

AWS KMS Envelope Encryption
Estimated Time:2m 0s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic