Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is building a Python application running on Amazon ECS that must encrypt JSON telemetry reports of approximately 80 KB80\text{ KB} each before storing them in an Amazon S3 bucket. The application must use AWS Key Management Service (AWS KMS) for encryption. Which approach should the developer implement to meet these requirements?

  1. A
    Configure the ECS task definition with an ECS Task Execution Role that has `kms:GenerateDataKey` permissions, and call the KMS `GenerateDataKey` API operation from the application code to obtain the keys.
  2. Call the KMS `GenerateDataKey` API operation using a customer managed key to obtain a plaintext data key and an encrypted data key. Encrypt the telemetry report locally using the plaintext data key, upload both the encrypted report and the encrypted data key to the S3 bucket, and then delete the plaintext data key from memory.Answer
  3. C
    Call the KMS `Encrypt` API operation directly, passing the 80 KB80\text{ KB} telemetry report as the `Plaintext` parameter, and upload the returned ciphertext to the S3 bucket.
  4. D
    Generate a symmetric key locally within the application code, store that key in AWS Secrets Manager, retrieve it using the Secrets Manager API to encrypt each telemetry report, and upload the encrypted reports to the S3 bucket.

Answer

Calling the KMS `GenerateDataKey` API operation to obtain a plaintext and encrypted data key, performing local encryption with the plaintext key, storing the encrypted data and encrypted key, and deleting the plaintext key from memory.
The correct approach uses client-side envelope encryption. Since the JSON payload size is 80 KB80\text{ KB}, direct encryption via the KMS `Encrypt` API is not possible due to its 4 KB4\text{ KB} limit. By calling `GenerateDataKey` with a customer managed key, the application receives a plaintext data key to perform local encryption using a symmetric algorithm (like AES-256) and an encrypted data key. The application uploads the ciphertext data and the encrypted data key to the S3 bucket, then deletes the plaintext key from memory to prevent security leaks. Accessing KMS requires the credentials of the ECS Task Role, which is used by the application code.

Step-by-Step Solution

1
Analyze the size of the telemetry report payload.
The telemetry report is 80 KB80\text{ KB}, which is larger than the 4 KB4\text{ KB} direct encryption limit of the KMS `Encrypt` API.
Determines that the application must use envelope encryption rather than sending the raw payload to KMS.
2
Choose the appropriate KMS API operation for envelope encryption.
The KMS `GenerateDataKey` API operation is selected to generate the plaintext and encrypted versions of the data key.
Allows the application to encrypt the 80 KB80\text{ KB} payload locally using the plaintext key and store the encrypted key with the data.
3
Verify ECS IAM configuration.
Ensure the KMS permission policy is attached to the ECS Task Role.
The application code running in the container relies on the Task Role for AWS SDK credentials, not the Task Execution Role.

Key Concept

AWS KMS Envelope Encryption and ECS IAM Roles
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic