Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing client-side decryption for a microservice that retrieves encrypted configuration files (each under 1010 KB in size) from an external datastore. The files were encrypted using envelope encryption with an AWS KMS customer managed key. The datastore contains the ciphertext payload and the encrypted data key (ciphertext data key). Which two steps must the developer's application perform to decrypt the payload?

  1. Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to retrieve the plaintext data key.Answer
  2. Decrypt the ciphertext payload locally using the retrieved plaintext data key and the appropriate decryption algorithm.Answer
  3. C
    Call the Decrypt API operation of AWS KMS, passing the ciphertext payload directly to retrieve the decrypted plaintext payload.
  4. D
    Retrieve the plaintext data key from AWS Systems Manager Parameter Store by querying a SecureString parameter.
  5. E
    Call the GenerateDataKey API operation of AWS KMS, passing the ciphertext data key to recover the plaintext data key.

Answer

To decrypt the payload, the application must call the KMS Decrypt API operation with the ciphertext data key to get the plaintext data key, and then decrypt the ciphertext payload locally using that plaintext data key.
To decrypt a payload that was encrypted using envelope encryption, the client application first extracts the encrypted data key (ciphertext data key) that is stored alongside the payload. The application then sends this ciphertext data key to AWS KMS by calling the Decrypt API operation. AWS KMS decrypts the data key using the specified customer managed key and returns the plaintext data key to the application. Finally, the application uses this plaintext data key to decrypt the ciphertext payload locally. This ensures that the heavy decryption workload is done client-side and the sensitive raw payload is never sent over the network to AWS KMS.

Step-by-Step Solution

1
Isolate the ciphertext data key.
The ciphertext data key is separated from the encrypted configuration payload.
AWS KMS envelope encryption requires decrypting the data key before the data itself can be decrypted.
2
Decrypt the data key via AWS KMS.
AWS KMS decrypts the ciphertext data key and returns the plaintext data key.
The client application does not have access to the backing customer managed key and must delegate decryption of the data key to AWS KMS.
3
Decrypt the payload locally.
The configuration payload is decrypted back to plaintext.
Performing decryption locally avoids the network overhead of sending the payload to AWS KMS and bypasses the payload size limits of the KMS Decrypt API.

Key Concept

AWS KMS Envelope Encryption Decryption Workflow
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic