An application needs to decrypt locally stored database backups that were encrypted using client-side envelope encryption with an AWS Key Management Service (AWS KMS) Customer Managed Key (CMK). The application has access to the encrypted database backups and the encrypted data key that was packaged with the backup. Which two actions must the developer perform in the application code to decrypt the database backups?
- Call the KMS Decrypt API passing the encrypted data key to retrieve the plaintext data key.Answer
- Decrypt the database backup locally using the retrieved plaintext data key and a symmetric encryption algorithm.Answer
- CCall the KMS GenerateDataKey API to recreate the original plaintext data key.
- DCall the KMS Decrypt API passing the entire database backup payload directly to KMS to decrypt it.
- ERetrieve the plaintext data key from Systems Manager Parameter Store where it was automatically stored during the encryption process.
Answer
Call the KMS Decrypt API passing the encrypted data key to retrieve the plaintext data key, and decrypt the database backup locally using the retrieved plaintext data key and a symmetric encryption algorithm.
In envelope encryption, data is encrypted locally using a unique symmetric data key, and the data key itself is encrypted using a KMS Customer Managed Key. To decrypt the data, the application must send the encrypted data key to the KMS Decrypt API to obtain the plaintext data key. After receiving the plaintext key, the application uses it locally to decrypt the large backup file using a symmetric algorithm such as AES.
Step-by-Step Solution
Key Concept
AWS KMS Envelope Decryption Workflow