Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is designing a data archival application that needs to encrypt database export files that are approximately 45 MB45\text{ MB} in size before uploading them to an Amazon S3 bucket. The security policy requires client-side envelope encryption using an AWS KMS customer managed key.

Which of the following application workflows satisfies these requirements with the minimum number of AWS KMS API requests?

  1. Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted copy of the data key. Encrypt the database export file using the plaintext data key, discard the plaintext data key from memory, and upload the encrypted file along with the encrypted data key to S3.Answer
  2. B
    Call the KMS Encrypt API directly, passing the database export file as the plaintext payload, and upload the resulting ciphertext to S3.
  3. C
    Call the KMS GenerateDataKeyWithoutPlaintext API to obtain the encrypted data key. Call the KMS Decrypt API to retrieve the plaintext data key, encrypt the file, and upload the encrypted file along with the encrypted data key to S3.
  4. D
    Create a secure string parameter in Systems Manager Parameter Store containing a static symmetric key, retrieve it using the GetParameter API, encrypt the file client-side, and upload the encrypted file to S3.

Answer

Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted copy of the data key. Encrypt the database export file using the plaintext data key, discard the plaintext data key from memory, and upload the encrypted file along with the encrypted data key to S3.
The correct workflow involves calling the KMS GenerateDataKey API, which returns both the plaintext data key and the encrypted data key in a single API call. The plaintext key is used to encrypt the 45 MB45\text{ MB} file client-side, and then it is immediately discarded from memory for security. The encrypted data key is uploaded to Amazon S3 alongside the encrypted file so that authorized users can decrypt it later by calling the KMS Decrypt API.

Step-by-Step Solution

1
Determine the file size constraint and the appropriate encryption method.
Since the database export file is 45 MB45\text{ MB}, it exceeds the 4 KB4\text{ KB} limit of the KMS Encrypt API, requiring client-side envelope encryption.
KMS has direct payload limits, meaning large files must be encrypted locally using a symmetric data key generated by KMS.
2
Select the KMS API call that generates both the plaintext and encrypted keys in one request.
GenerateDataKey returns both the plaintext key and the ciphertext key in a single API call.
This minimizes the number of KMS API calls compared to calling GenerateDataKeyWithoutPlaintext followed by Decrypt.
3
Define the client-side encryption and storage workflow.
Encrypt the file with the plaintext key, delete the plaintext key from memory, and upload the encrypted file and encrypted key together.
This ensures the plaintext key is not exposed after encryption, and the encrypted key is available for future decryption operations.

Key Concept

AWS KMS Envelope Encryption Workflow and API Selection
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic