Examkin

Question

Difficulty: MediumAWS KMS and Encryption

An application running on Amazon ECS needs to decrypt sensitive customer configuration files that were previously encrypted using client-side envelope encryption with an AWS KMS customer managed key. The application has access to the encrypted files and the corresponding ciphertext data keys stored alongside them. Which TWO actions must the developer implement in the application code to retrieve the original configuration files?

  1. Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to obtain the plaintext data key.Answer
  2. Decrypt the configuration file locally using the plaintext data key and a symmetric decryption algorithm.Answer
  3. C
    Call the Decrypt API operation of AWS KMS, passing the entire encrypted configuration file to AWS KMS.
  4. D
    Call the GenerateDataKey API operation of AWS KMS using the customer managed key to retrieve the plaintext decryption key.
  5. E
    Call the AWS Secrets Manager GetSecretValue API using the customer managed key identifier to fetch the stored plaintext data key.

Answer

To retrieve the original configuration files, the developer must call the Decrypt API operation of AWS KMS to decrypt the ciphertext data key, and then decrypt the configuration file locally using the resulting plaintext data key.
The correct solution involves calling the AWS KMS Decrypt API operation with the ciphertext data key to get the plaintext data key, and then using that key to decrypt the payload locally. This process separates key management from data processing, satisfying envelope encryption requirements.

Step-by-Step Solution

1
Retrieve the ciphertext data key that is stored alongside the encrypted configuration file.
The application has the encrypted data key ready for the API call.
The ciphertext data key must be decrypted by AWS KMS because only the KMS customer managed key can decrypt it.
2
Call the AWS KMS Decrypt API passing the ciphertext data key as a parameter.
AWS KMS returns the plaintext data key.
The application needs the plaintext data key in memory to perform the local decryption algorithm.
3
Perform local symmetric decryption of the configuration file using the plaintext data key.
The configuration file is returned to its original plaintext form.
Under client-side envelope encryption, actual data decryption is done by the client application to avoid sending large payloads over the network.

Key Concept

Client-side envelope decryption workflow using AWS KMS
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic