Examkin

Question

Difficulty: EasyAWS KMS and Encryption

A developer needs to encrypt a configuration file containing sensitive database credentials. The file size is 2 KB2\text{ KB}, and the developer decides to use direct encryption with an AWS Key Management Service (AWS KMS) customer managed key before uploading the file to Amazon S3. Which of the following actions must be taken to successfully encrypt this file? (Select TWO.)

  1. Call the `Encrypt` API operation, passing the plaintext configuration data and the customer managed key identifier.Answer
  2. Configure the KMS key policy of the customer managed key to grant the application's IAM role permission to perform the `kms:Encrypt` action.Answer
  3. C
    Call the `GenerateDataKey` API operation to perform client-side envelope encryption, as direct encryption is not supported for files smaller than 64 KB64\text{ KB}.
  4. D
    Call the `GenerateDataKeyWithoutPlaintext` API operation to generate a plaintext data key for local file encryption.
  5. E
    Store the configuration file in AWS Systems Manager Parameter Store as a `SecureString` to automatically trigger direct KMS encryption on the file object.

Answer

The configuration file can be encrypted by calling the KMS `Encrypt` API operation directly, and the application's IAM role must have the `kms:Encrypt` permission allowed in the customer managed key's key policy.
Direct encryption using the KMS `Encrypt` API operation is suitable for data payloads up to 4 KB4\text{ KB}. To perform this action, the caller's IAM role must be granted permissions in the customer managed key's key policy.

Step-by-Step Solution

1
Determine the size of the payload to be encrypted.
The file size is 2 KB2\text{ KB}, which is under the 4 KB4\text{ KB} limit for direct KMS encryption.
Knowing the payload size helps determine whether direct encryption or envelope encryption is appropriate.
2
Verify key policy permissions.
Ensure the KMS key policy allows the IAM role to call `kms:Encrypt`.
KMS key policies must explicitly grant usage permissions even if the IAM policy allows it.
3
Perform the encryption using the SDK.
Call the `Encrypt` API with the plaintext payload and the key ID.
This generates the ciphertext directly without generating local data keys.

Key Concept

Direct encryption with AWS KMS using the Encrypt API operation is suitable for small payloads up to 4 KB4\text{ KB}, provided that appropriate key policy permissions are configured.
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic