Examkin

Question

Difficulty: HardAWS KMS and Encryption

A developer is implementing a secure file upload utility in a Python application using the AWS SDK (Boto3). The utility must encrypt sensitive medical imaging files, each approximately 150 MB150\text{ MB} in size, client-side before uploading them to an Amazon S3 bucket. The application must use envelope encryption with a customer managed key (CMK) in AWS KMS to manage the encryption keys. Which programmatic workflow should the developer implement to encrypt each file while minimizing AWS KMS API calls and network overhead?

  1. Call the generate_data_key API method passing the CMK identifier and specifying the AES_256 key spec. Use the returned plaintext data key to encrypt the file locally. Upload the encrypted file and the returned ciphertext data key to Amazon S3, then purge the plaintext data key from memory.Answer
  2. B
    Call the generate_data_key_without_plaintext API method passing the CMK identifier. Call the decrypt API method passing the returned ciphertext data key to retrieve the plaintext data key. Use the plaintext data key to encrypt the file locally, then upload the encrypted file and the ciphertext data key to Amazon S3.
  3. C
    Call the encrypt API method passing the CMK identifier and the file contents in 4 KB4\text{ KB} chunks. Concatenate the returned ciphertexts and upload the final consolidated file to Amazon S3.
  4. D
    Call the generate_data_key API method to retrieve a plaintext data key and a ciphertext data key. Call the encrypt API method passing the plaintext data key to encrypt it again with the CMK. Use the newly encrypted data key to encrypt the file, and upload the file to Amazon S3.

Answer

Call the generate_data_key API method passing the CMK identifier and specifying the AES_256 key spec. Use the returned plaintext data key to encrypt the file locally. Upload the encrypted file and the returned ciphertext data key to Amazon S3, then purge the plaintext data key from memory.
The correct workflow is to call the generate_data_key API method, which returns both the plaintext data key (to immediately encrypt the file locally) and the ciphertext data key (to be uploaded to S3 along with the encrypted file). This ensures the envelope encryption is completed in a single KMS API call and local resources do not retain the plaintext key in memory after encryption.

Step-by-Step Solution

1
Generate the data key using the KMS customer managed key (CMK).
A plaintext data key and a ciphertext (encrypted) data key are returned by AWS KMS in a single API call.
Calling generate_data_key generates both key representations, avoiding the need for separate generation and encryption API calls.
2
Perform client-side encryption on the medical imaging file.
The file is encrypted locally using the plaintext data key and a symmetric encryption algorithm (like AES-256).
Local encryption keeps the large file payload (150 MB150\text{ MB}) out of KMS network transits, complying with KMS payload limits.
3
Store the encrypted file and the ciphertext data key in Amazon S3, and clean up memory.
The encrypted payload and ciphertext data key are uploaded to S3, and the plaintext data key is removed from application memory.
Storing the ciphertext data key alongside the encrypted file ensures it can be decrypted later, while purging the plaintext key secures it against memory-based attacks.

Key Concept

AWS KMS client-side envelope encryption workflow utilizing generate_data_key.
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic