Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A backend service must encrypt large archives of user data locally before uploading them to a third-party storage provider. The developer needs to implement envelope encryption using a customer managed key in AWS KMS. The service needs to obtain a data key that can be used to encrypt the archives immediately and then be discarded from memory.

Which AWS KMS API operation should the developer invoke to retrieve the required data key?

  1. A
    Encrypt
  2. GenerateDataKeyAnswer
  3. C
    GenerateDataKeyWithoutPlaintext
  4. D
    Decrypt

Answer

GenerateDataKey
The correct answer is the operation GenerateDataKey. In envelope encryption, the application needs to encrypt data locally. It calls the GenerateDataKey API, which returns a plaintext data key and an encrypted data key. The application uses the plaintext data key to encrypt the data, discards the plaintext key from memory, and stores the encrypted data key alongside the encrypted data.

Step-by-Step Solution

1
Determine the type of encryption required.
Envelope encryption is required because the application needs to encrypt large archives locally before upload.
Direct KMS encryption via the Encrypt API is limited to 4 KB4\text{ KB} payloads, so client-side envelope encryption must be used for larger files.
2
Identify the state of the data key needed.
The application needs the plaintext data key to perform the encryption immediately, and the encrypted data key to store alongside the ciphertext.
Encryption requires a plaintext key, but for security, the plaintext key is discarded after use and only the encrypted key is saved for future decryption.
3
Select the correct KMS API operation.
GenerateDataKey is selected.
GenerateDataKey returns both the plaintext and ciphertext versions of the data key, satisfying the requirement to encrypt immediately. GenerateDataKeyWithoutPlaintext only returns the ciphertext version.

Key Concept

KMS Envelope Encryption API operations
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic