Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is writing an AWS Lambda function that receives customer registration data payloads of approximately 50 KB50\text{ KB} each. The security policy requires this data to be encrypted client-side using a Customer Managed Key (CMK) in AWS KMS before it is written to an Amazon DynamoDB table. Which of the following steps must the developer perform to encrypt the payload and store it in DynamoDB? (Select TWO.)

  1. Call the GenerateDataKey API operation on AWS KMS using the Customer Managed Key to receive both a plaintext data key and an encrypted data key.Answer
  2. Encrypt the payload locally using the plaintext data key, store both the encrypted payload and the encrypted data key in the DynamoDB table, and erase the plaintext data key from memory.Answer
  3. C
    Call the Encrypt API operation on AWS KMS directly, passing the entire 50 KB50\text{ KB} payload and the Customer Managed Key identifier.
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation on AWS KMS to get an encrypted data key, decrypt the key locally using the AWS SDK offline utilities, and encrypt the payload.
  5. E
    Encrypt the payload locally using the plaintext data key, and store the plaintext data key in AWS Systems Manager Parameter Store with a secure string type for later decryption.

Answer

The developer must call the GenerateDataKey API operation to obtain the plaintext and encrypted data keys, encrypt the data locally, store the encrypted payload and the encrypted data key in DynamoDB, and immediately purge the plaintext data key from memory.
Because the payload (50 KB50\text{ KB}) is larger than the 4 KB4\text{ KB} maximum allowed by the direct AWS KMS Encrypt API, envelope encryption is required. The developer calls GenerateDataKey to obtain both the plaintext data key (for local encryption) and the encrypted data key. After local encryption, the plaintext key is discarded from memory, and the encrypted data key is stored alongside the encrypted payload in DynamoDB.

Step-by-Step Solution

1
Determine the encryption strategy based on payload size.
Since the 50 KB50\text{ KB} payload exceeds the 4 KB4\text{ KB} direct encryption limit of AWS KMS, client-side envelope encryption must be used.
Direct KMS Encrypt/Decrypt APIs cannot handle payloads larger than 40964096 bytes.
2
Request a data key from AWS KMS.
Invoke the GenerateDataKey API using the Customer Managed Key identifier to receive both the plaintext data key and the encrypted data key.
This provides the required cryptographic material for local encryption and safe storage of the key.
3
Encrypt the data locally and manage the keys.
Encrypt the data using the plaintext key, erase the plaintext key from memory, and write the encrypted payload along with the encrypted data key to DynamoDB.
This secures the payload client-side while ensuring the plaintext key is never stored, complying with security best practices.

Key Concept

KMS Client-Side Envelope Encryption and Payload Size Limits
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic