Examkin

Question

Difficulty: EasyAWS KMS and Encryption

A developer is writing a backend application hosted on AWS Lambda that needs to decrypt a sensitive database connection string. The connection string was previously encrypted directly using an AWS KMS customer managed key (CMK). The Lambda function's IAM execution role has been granted permissions to use the key. Which AWS KMS API action must the developer invoke within the application code to retrieve the plaintext connection string?

  1. DecryptAnswer
  2. B
    GenerateDataKey
  3. C
    GetSecretValue
  4. D
    ReEncrypt

Answer

Decrypt
The Decrypt API operation is the correct action to call because it decrypts ciphertext that was encrypted directly using an AWS KMS key, returning the decrypted plaintext to the application.

Step-by-Step Solution

1
Identify the source of encryption and the desired output.
The database connection string was encrypted directly using an AWS KMS customer managed key, and the application needs to retrieve the plaintext string.
This establishes that we are dealing with direct decryption of KMS ciphertext rather than local envelope encryption or retrieving a secret from a secret store.
2
Select the correct AWS KMS API operation for direct decryption.
The Decrypt operation is selected.
The Decrypt API operation takes ciphertext encrypted under a KMS key and returns the decrypted plaintext, which matches the application's requirement.

Key Concept

Direct decryption using AWS KMS API
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic