Security

390 questions

All types390 Multiple choice195 Multiple select195

A developer is implementing a secure audit logging system where an application running on Amazon EC2 instances encrypts log files locally before uploading them to Amazon S3. A separate analytics service running on AWS Fargate needs to decrypt and process these log files. The developer wants to use a customer managed key (CMK) in AWS KMS for envelope encryption and must ensure that all encryption and decryption operations are cryptographically bound to the encryption context `{"Project": "Audit"}`.

Which TWO actions must the developer perform to successfully implement this security architecture?

Select all that apply

In the EC2 application code, call the `GenerateDataKey` API operation using the KMS key identifier and passing the encryption context `{"Project": "Audit"}` to retrieve both the plaintext data key and the encrypted data key.

In the ECS task role policy of the Fargate service, grant `kms:Decrypt` permission for the CMK, and include a condition block that checks the `kms:EncryptionContext:Project` key is equal to `"Audit"`.

In the EC2 application code, call the `Encrypt` API operation with the KMS key identifier and the encryption context `{"Project": "Audit"}` to directly encrypt each log file before upload.

In the EC2 application code, call the `GenerateDataKeyWithoutPlaintext` API operation with the encryption context `{"Project": "Audit"}`, then call `Decrypt` on the returned ciphertext key to get the plaintext key for local encryption.

In the ECS task execution role policy of the Fargate service, grant `kms:Decrypt` permission for the CMK, and append the encryption context value to the resource ARN.

Show answer & explanation

Answer: In the EC2 application code, call the `GenerateDataKey` API operation using the KMS key identifier and passing the encryption context `{"Project": "Audit"}` to retrieve both the plaintext data key and the encrypted data key.; In the ECS task role policy of the Fargate service, grant `kms:Decrypt` permission for the CMK, and include a condition block that checks the `kms:EncryptionContext:Project` key is equal to `"Audit"`.

Answer

In the EC2 application code, call the GenerateDataKey API operation using the KMS key identifier and passing the encryption context {"Project": "Audit"} to retrieve both the plaintext data key and the encrypted data key; and in the ECS task role policy of the Fargate service, grant kms:Decrypt permission for the CMK, and include a condition block that checks the kms:EncryptionContext:Project key is equal to "Audit".

The correct options describe the proper implementation of client-side envelope encryption and IAM policy configuration. To encrypt files of arbitrary size, the producer must generate a data key using the `GenerateDataKey` API, passing the required encryption context. This context is cryptographically bound to the data key. On the consuming side, the application running inside the Fargate container needs permissions to decrypt the data key. Since this is an application runtime activity, the permission must be granted to the Fargate Task Role (rather than the Task Execution Role). The security policy enforces the use of the correct encryption context by using a condition block checking for the `kms:EncryptionContext:Project` key.

Step-by-Step Solution

Generate the data key for envelope encryption

The EC2 application makes a call to `GenerateDataKey` passing the customer managed key identifier and `{"Project": "Audit"}` as the encryption context. This returns both the plaintext data key and the ciphertext data key.

Envelope encryption requires a local plaintext key to perform symmetric encryption on the file, and an encrypted copy of the key to store alongside the ciphertext.

Encrypt the log file locally and discard the plaintext key

The log file is encrypted with the plaintext data key. The plaintext data key is then deleted from memory, and the encrypted data key is stored as metadata with the log file in S3.

Discarding the plaintext key from memory after use ensures that only the encrypted data key remains, protecting the data at rest.

Configure the Fargate task permissions and policy conditions

The Fargate service's ECS task role policy is configured to allow `kms:Decrypt` on the CMK, constrained by a policy condition requiring `kms:EncryptionContext:Project` to be `"Audit"`.

The consumer service needs the task role (not the task execution role) to decrypt the data key during application runtime, and the policy condition enforces cryptographic context binding.

Decrypt the log file on Fargate

The Fargate consumer downloads the log and the encrypted data key, then calls `Decrypt` on the data key passing the exact encryption context `{"Project": "Audit"}`. It receives the plaintext key and decrypts the log file.

KMS will reject the decryption request if the encryption context passed to the API does not match the context used during key generation.

Key Concept

AWS KMS envelope encryption workflows, encryption context binding, and proper IAM role configuration for containerized services.

Estimated Time:2m 30s

Question 182Question →

A developer is configuring security for an Amazon API Gateway REST API. The API needs to validate JSON Web Tokens (JWT) issued by an Amazon Cognito User Pool. Additionally, the backend Lambda function, which is integrated using a Lambda Proxy integration, must be able to read the user's group memberships to apply application-level authorization. Which two configuration steps should the developer perform to achieve this? (Select TWO.)

Select all that apply

Create an Amazon Cognito User Pool authorizer in API Gateway, pointing to the user pool, and set the Identity Source to read the Authorization header.

Configure the API Gateway resource methods to use the Cognito User Pool authorizer, and extract the group memberships from the request context authorizer claims in the Lambda function.

Create an Amazon Cognito Identity Pool authorizer in API Gateway, and configure the clients to sign API requests using AWS Signature Version 4.

Deploy a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from Cognito to verify the JWT and inject the groups into custom headers for every request.

Configure a Lambda Custom integration and define an API Gateway mapping template to extract the Cognito claims from the request headers and map them into the event object.

Show answer & explanation

Answer: Create an Amazon Cognito User Pool authorizer in API Gateway, pointing to the user pool, and set the Identity Source to read the Authorization header.; Configure the API Gateway resource methods to use the Cognito User Pool authorizer, and extract the group memberships from the request context authorizer claims in the Lambda function.

Answer

Create a Cognito User Pool authorizer configured to read the Authorization header, associate it with the API methods, and access the groups from the event request context authorizer claims in the Lambda function.

The correct options describe creating a Cognito User Pool authorizer and configuring it on the API methods, while retrieving the token claims directly from the request context authorizer claims. This provides a secure, native, and low-latency solution that leverages API Gateway's built-in validation capabilities. Under a Lambda Proxy integration, the validated token claims are automatically passed to the Lambda function's event payload.

Step-by-Step Solution

Create and configure a Cognito User Pool authorizer in Amazon API Gateway.

API Gateway is configured to automatically inspect the token source header (e.g., Authorization) and validate the JWT signature against the Cognito User Pool.

This establishes native token validation at the API Gateway layer without writing custom authorizer code.

Set the API methods to use the created Cognito User Pool authorizer.

The API resources are secured, and unauthenticated requests are blocked with a 401 Unauthorized status.

This applies the authorizer security to the specific methods that require authentication.

Access the user's groups in the backend Lambda function from the proxy event context.

The Lambda function code retrieves claims from the event structure at `event.requestContext.authorizer.claims['cognito:groups']`.

Since the API uses a Lambda Proxy integration, API Gateway automatically passes the validated token claims down to the backend integration.

Key Concept

API Gateway Cognito User Pool Authorizers and requestContext claims propagation with Lambda Proxy integration.

Question 183Question →

An organization is designing a B2B integration platform where partner companies consume API endpoints exposed via an Amazon API Gateway REST API. The partners authenticate using a third-party Identity Provider (IdP) and obtain a custom JWT containing a partnerId claim. The organization requires that partners can only access API paths matching /partners/{partnerId}/*. Which solution should a developer implement to meet these authorization requirements with the least administrative complexity?

Implement an API Gateway Lambda authorizer. In the authorizer function, validate the custom JWT and verify the signature using the Identity Provider's public keys. Extract the partnerId claim and return an IAM policy to API Gateway that grants execute-api:Invoke permissions exclusively on the resource path corresponding to /partners/{partnerId}/*.

Configure an Amazon Cognito User Pool authorizer on the REST API. Define a custom attribute for the user pool to store the partnerId. Configure API Gateway Method Request validation to match the partnerId claim from the Cognito authorizer with the path parameter before invoking the backend integration.

Federate the external Identity Provider with an Amazon Cognito Identity Pool. Exchange the custom JWT for temporary AWS credentials. Have the partner applications sign their API requests using AWS Signature Version 4, and configure the REST API methods to use the built-in Cognito User Pool authorizer.

Implement an API Gateway Lambda authorizer in request mode. Pass the custom JWT to a Lambda Proxy Integration. In the backend Lambda function, extract the partnerId from the request context and write a resource policy attached to the API Gateway API to dynamically restrict access to the /partners/{partnerId}/* path.

Show answer & explanation

Answer: Implement an API Gateway Lambda authorizer. In the authorizer function, validate the custom JWT and verify the signature using the Identity Provider's public keys. Extract the partnerId claim and return an IAM policy to API Gateway that grants execute-api:Invoke permissions exclusively on the resource path corresponding to /partners/{partnerId}/*.

Answer

Implement an API Gateway Lambda authorizer to validate the JWT and dynamically generate an IAM policy that allows access only to /partners/{partnerId}/*.

The correct solution involves deploying a Lambda authorizer. The Lambda authorizer receives the token, validates its signature against the IdP's JWKS (JSON Web Key Set), extracts the partnerId claim, and dynamically constructs an IAM policy. This IAM policy grants execute-api:Invoke permission specifically on the ARN pattern arn:aws:execute-api:region:account-id:api-id/stage/GET/partners/{partnerId}/*, enforcing least-privilege access control at the API Gateway boundary.

Step-by-Step Solution

Determine if Cognito User Pool Authorizer can validate external JWTs directly.

It cannot, as Cognito User Pool authorizers are designed for Amazon Cognito User Pools.

Identifies that a Lambda authorizer or Cognito federation is required.

Analyze how to enforce path-based access control based on JWT claims dynamically.

A Lambda authorizer can extract the partnerId claim and return a dynamically generated IAM policy.

Enforces least privilege at the API Gateway layer before the backend is invoked.

Evaluate the configuration complexity of the proposed solutions.

Using a Lambda authorizer keeps the architecture simple by validating and authorizing in one step without Cognito Identity Pool federation.

Selects the solution with the least operational overhead.

Key Concept

API Gateway Lambda Authorizer with Dynamic Policy Generation

Estimated Time:2m 0s

Question 184Question →

A developer has configured an application running on an Amazon EC2 instance to decrypt database credentials using an AWS KMS customer managed key. The EC2 instance profile has an IAM policy attached that allows the `kms:Decrypt` action on the key's Amazon Resource Name (ARN). However, the application receives an `AccessDeniedException` error when attempting to decrypt the credentials. Which configuration change is required to resolve this authorization error?

Update the trust policy of the EC2 instance's IAM role to allow the `kms.amazonaws.com` service principal to assume the role.

Modify the KMS key policy to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.

Use the `GenerateDataKey` API operation to download the plaintext private key of the customer managed key, storing it locally to decrypt the credentials without invoking KMS.

Migrate the credentials to Systems Manager Parameter Store as a Standard string parameter to bypass AWS KMS validation checks.

Show answer & explanation

Answer: Modify the KMS key policy to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.

Answer

Modify the KMS key policy to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.

For AWS KMS customer managed keys, authorization is determined by both the key policy and IAM policies. If the key policy does not explicitly permit the caller or delegate authority to the root AWS account (which allows IAM policies to take effect), any IAM policies permitting KMS actions will have no effect, resulting in an AccessDeniedException. Granting the EC2 role access in the key policy resolves the issue.

Step-by-Step Solution

Determine the resource authorization hierarchy for AWS KMS.

Unlike other services, AWS KMS requires that the key policy itself explicitly grants access, either directly or by delegating control to the account's IAM policies.

If the key policy is not configured to trust the IAM role or the root account, all IAM permissions for that key will be ignored.

Verify if the key policy of the customer managed key contains an allow statement for the caller's IAM role.

The key policy does not delegate control or explicitly authorize the EC2 role.

This results in an AccessDeniedException despite the presence of the IAM policy.

Add the required permissions statement to the KMS key policy.

The key policy is updated to include the EC2 instance profile's IAM role ARN as a Principal with the `kms:Decrypt` action.

This satisfies the KMS authorization check and allows the application to decrypt the credentials.

Key Concept

AWS KMS Key Policy Authorization

Estimated Time:1m 30s

Question 185Question →

A developer is building a healthcare application that processes patient medical images. Each image file is approximately $25\text{ MB}$ in size. The developer needs to encrypt these images locally using client-side envelope encryption with an AWS KMS customer managed key before uploading them to an Amazon S3 bucket.

Which of the following steps must the developer perform to complete this encryption process? (Select TWO.)

Select all that apply

Call the AWS KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key.

Encrypt the medical image file locally using the plaintext data key, and then delete the plaintext data key from memory.

Call the AWS KMS Encrypt API operation to encrypt the entire image file directly in the cloud.

Upload the plaintext data key to AWS Secrets Manager to make it available for future decryption operations.

Export the private key material of the KMS customer managed key to perform the encryption on the local server.

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key.; Encrypt the medical image file locally using the plaintext data key, and then delete the plaintext data key from memory.

Answer

To perform client-side envelope encryption, the developer must call the AWS KMS GenerateDataKey operation to retrieve a plaintext data key and an encrypted data key, encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.

The correct workflow for client-side envelope encryption requires generating a data key using the GenerateDataKey API operation. This provides a plaintext data key to perform the local symmetric encryption on the

25\text{ MB}

image and an encrypted data key. Once the file is encrypted, the plaintext data key must be removed from memory to ensure security.

Step-by-Step Solution

Call the GenerateDataKey API operation.

AWS KMS returns a plaintext data key and an encrypted data key.

The plaintext data key is required to perform the local encryption, and the encrypted data key will be stored alongside the encrypted file.

Perform local encryption using a cryptographic library.

The medical image file is encrypted locally.

Since the file exceeds the

4\text{ KB}

limit of the KMS Encrypt API, the encryption must be handled locally on the application host.

Delete the plaintext data key from memory and package the encrypted key with the ciphertext.

The plaintext key is removed, and the encrypted data key is saved with the encrypted image.

Removing the plaintext data key from memory prevents security risks. Storing the encrypted data key alongside the ciphertext is necessary for future decryption.

Key Concept

AWS KMS client-side envelope encryption workflow for payloads exceeding the KMS API size limits.

Question 186Question →

An organization requires a new microservice backend to run on AWS Lambda within a custom VPC. The function must query an Amazon Aurora MySQL database residing in a private subnet. The function also needs to retrieve database credentials from AWS Secrets Manager without any traffic transiting the public internet.

Which configuration should a developer implement to meet these requirements securely?

Associate the Lambda function with the private subnets. Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnets to send internet-bound traffic to the NAT Gateway.

Associate the Lambda function with the private subnets. Provision an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow inbound HTTPS traffic from the Lambda function's security group to the endpoint.

Associate the Lambda function with the private subnets. Store the credentials in Systems Manager Parameter Store, and set up a gateway VPC endpoint to route API calls directly to Parameter Store.

Configure the Lambda function execution role trust policy to trust the Secrets Manager service principal, and assign an IAM policy allowing access to Secrets Manager.

Show answer & explanation

Answer: Associate the Lambda function with the private subnets. Provision an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow inbound HTTPS traffic from the Lambda function's security group to the endpoint.

Answer

The correct solution involves associating the Lambda function with the private subnets where the database resides and provisioning an interface VPC endpoint for Secrets Manager. The security groups are then configured to allow inbound HTTPS traffic from the Lambda function to the endpoint. This satisfies all requirements: Lambda can query the Aurora database, and the credentials from Secrets Manager are retrieved securely over private IP addresses within the AWS network without transiting the public internet.

Step-by-Step Solution

Associate the Lambda function with the private subnets of the VPC.

The Lambda function receives elastic network interfaces (ENIs) inside the private subnets, enabling network connectivity to the Aurora database.

By default, Lambda functions run in a secure service VPC and cannot access resources in a customer's private subnets unless VPC association is configured.

Provision an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.

Private IP addresses are allocated in the private subnets for the endpoint, resolving hostnames privately within the VPC.

An interface VPC endpoint is required to access AWS Secrets Manager without routing requests through a NAT Gateway or transiting the public internet.

Configure the security groups of the interface VPC endpoint to allow inbound HTTPS (port 443) traffic from the Lambda function's security group.

The firewall rules are updated to permit secure HTTPS connections from the Lambda function to the Secrets Manager endpoint.

Interface VPC endpoints use security groups to restrict network access, and they must explicitly permit incoming traffic from the clients.

Key Concept

VPC endpoints enable private connection between a VPC and supported AWS services without requiring internet gateways, NAT devices, or VPN connections. Security groups must be configured to allow communication between resources and interface endpoints.

Question 187Question →

A developer is building a serverless backend for a mobile application. The APIs are exposed via an Amazon API Gateway REST API. The application uses an Amazon Cognito User Pool for user authentication. The developer needs to secure the API Gateway methods so that only authenticated users can access them. Additionally, the backend Lambda function must access the authenticated user's custom attribute, `custom:department`, to perform fine-grained data authorization. The client application is configured to pass the user's ID token in the HTTP `Authorization` header.

Which two configuration steps must the developer perform to meet these requirements?

Select all that apply

Configure an API Gateway Cognito User Pool authorizer that references the User Pool, and set the Token Source to `method.request.header.Authorization`.

Configure the API Gateway method to use Lambda proxy integration, and access the custom attributes in the backend Lambda function via the `event.requestContext.authorizer.claims` object.

Configure an API Gateway Lambda authorizer that downloads the JSON Web Key Set (JWKS) to manually verify the ID token signature and extract the claims.

Configure a Cognito Identity Pool to authenticate users, exchange their ID token for temporary AWS IAM credentials, and enable `AWS_IAM` authorization on the API Gateway method.

Configure the API Gateway method to use Lambda custom integration, and create an integration mapping template to map the custom attributes using `context.authorizer.claims`.

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pool authorizer that references the User Pool, and set the Token Source to `method.request.header.Authorization`.; Configure the API Gateway method to use Lambda proxy integration, and access the custom attributes in the backend Lambda function via the `event.requestContext.authorizer.claims` object.

Answer

Configure an API Gateway Cognito User Pool authorizer pointing to the User Pool with the appropriate token source, and configure the API Gateway method to use Lambda proxy integration to read the custom attribute claims under the request event context.

To secure the API Gateway REST API with Cognito User Pool users, the developer should configure a native API Gateway Cognito User Pool authorizer. This authorizer automatically validates the incoming JSON Web Token (JWT) signature and expiration. By specifying `method.request.header.Authorization` as the Token Source (or Identity Source), API Gateway expects the client to pass the token in that header. In addition, when the API Gateway method is configured with Lambda proxy integration, API Gateway automatically passes the validated token's claims (including custom user attributes) to the backend Lambda function. The function can access these claims directly in the event object under the `event.requestContext.authorizer.claims` path, which contains the `custom:department` claim.

Step-by-Step Solution

Configure an API Gateway Cognito User Pool authorizer.

API Gateway will natively validate incoming JSON Web Tokens (JWTs) from the specified User Pool using the `Authorization` header as the token source.

This eliminates the need to write custom validation logic in a Lambda authorizer, minimizing complexity and latency.

Configure the API Gateway method to use Lambda proxy integration.

The full request context, including authorization metadata, is automatically forwarded to the backend Lambda function.

Lambda proxy integration simplifies the interface, bypassing the need for manual integration mapping templates.

Access user attributes inside the Lambda function.

The backend code can directly read the claims from `event.requestContext.authorizer.claims['custom:department']`.

Cognito User Pool authorizers automatically populate user claims in the request context under the authorizer claims dictionary.

Key Concept

Securing API Gateway using Cognito User Pool Authorizers and passing identity context to a backend Lambda function using Lambda Proxy Integration.

Estimated Time:3m 0s

Question 188Question →

A developer is building a smart-home mobile application that connects to a backend hosted on Amazon API Gateway. Users authenticate with the application through an Amazon Cognito User Pool, which provides a JSON Web Token (JWT) upon login. The developer needs to secure the API Gateway REST API by verifying these JWTs before forwarding requests to the backend services.

Which of the following is the most operationally efficient method to authorize API requests using these JWTs?

Configure an Amazon Cognito Identity Pool authorizer on the Amazon API Gateway REST API.

Configure a built-in Amazon Cognito User Pool authorizer on the Amazon API Gateway REST API.

Create a custom Amazon Lambda authorizer to decode and validate the Cognito JWTs.

Enable Amazon Lambda Proxy integration on Amazon API Gateway to validate the Cognito JWTs within the backend Lambda function.

Show answer & explanation

Answer: Configure a built-in Amazon Cognito User Pool authorizer on the Amazon API Gateway REST API.

Answer

Configure a built-in Amazon Cognito User Pool authorizer on the Amazon API Gateway REST API.

The correct option is to configure a built-in Amazon Cognito User Pool authorizer. API Gateway natively integrates with Cognito User Pools to validate JWT identity tokens without requiring custom code or additional Lambda invocations, making it the most operationally efficient choice.

Step-by-Step Solution

Identify the token type and authentication provider.

The tokens are JWTs generated by an Amazon Cognito User Pool.

Determining the identity source is the first step in selecting the appropriate authorizer.

Evaluate native API Gateway features for the identity provider.

API Gateway provides a native Amazon Cognito User Pool authorizer to validate these JWTs.

Using built-in features reduces operational complexity and costs.

Configure the API Gateway authorizer.

The authorizer validates the token header natively before forwarding requests, blocking unauthorized access at the edge.

This secures the API boundary with the least administrative overhead.

Key Concept

API Gateway built-in Cognito User Pool Authorizers

Question 189Question →

A developer is configuring an AWS Lambda function to run inside a private subnet of a custom VPC. The function must retrieve configuration parameters from Systems Manager Parameter Store and send trace data to AWS X-Ray. Due to strict compliance guidelines, the VPC does not have a NAT Gateway or an Internet Gateway. Which two configurations must the developer implement to enable this connectivity? (Select TWO.)

Select all that apply

Create an interface VPC endpoint for Systems Manager (com.amazonaws.region.ssm) and associate it with the private subnets.

Create an interface VPC endpoint for AWS X-Ray (com.amazonaws.region.xray) and associate it with the private subnets.

Provision a NAT Gateway inside the private subnet, and update the private subnet's route table to direct 0.0.0.0/0 traffic to it.

Configure the Lambda function to retrieve values from AWS Secrets Manager using a gateway VPC endpoint.

Update the trust policy of the Lambda function's IAM execution role to trust the VPC endpoint service principal.

Show answer & explanation

Answer: Create an interface VPC endpoint for Systems Manager (com.amazonaws.region.ssm) and associate it with the private subnets.; Create an interface VPC endpoint for AWS X-Ray (com.amazonaws.region.xray) and associate it with the private subnets.

Answer

Create interface VPC endpoints for Systems Manager (com.amazonaws.region.ssm) and AWS X-Ray (com.amazonaws.region.xray) and associate them with the private subnets.

Because the Lambda function is deployed inside a private subnet without internet egress (no NAT Gateway or Internet Gateway), it cannot resolve and reach the public API endpoints of Systems Manager and AWS X-Ray. Implementing interface VPC endpoints (AWS PrivateLink) creates private elastic network interfaces (ENIs) with private IP addresses directly inside the private subnet. This routes traffic privately to the specified AWS services without exposing data to the public internet.

Step-by-Step Solution

Identify the destination services needed by the Lambda function.

The function must reach AWS Systems Manager (SSM) Parameter Store and AWS X-Ray.

This establishes the specific AWS service endpoints that require network pathways.

Select the correct connectivity mechanism for a VPC without internet egress (no NAT Gateway or Internet Gateway).

Determine that interface VPC endpoints (AWS PrivateLink) are required for SSM and X-Ray since gateway endpoints are not supported for these services.

AWS PrivateLink provisions private ENIs inside the subnets to route traffic locally and securely over the AWS network.

Configure the interface endpoints for com.amazonaws.region.ssm and com.amazonaws.region.xray.

The Lambda function inside the private subnet can now resolve these service endpoints to private IP addresses and successfully connect.

This establishes the necessary network endpoints for secure internal service resolution.

Key Concept

AWS PrivateLink and Interface VPC Endpoints for private AWS service communication

Question 190Question →

A developer is implementing client-side envelope encryption to secure local data files of size $10\text{ MB}$ . The developer calls the AWS KMS `GenerateDataKey` API operation. What does this API operation return to the developer's application?

Only the encrypted ciphertext data key

Both the plaintext data key and the encrypted ciphertext data key

The plaintext data key and the customer managed key

The encrypted data payload and the plaintext data key

Show answer & explanation

Answer: Both the plaintext data key and the encrypted ciphertext data key

Answer

Both the plaintext data key and the encrypted ciphertext data key

The GenerateDataKey API operation returns both a plaintext copy of the data key (used to encrypt the file locally in memory) and a ciphertext copy of the data key (encrypted with the specified KMS key, which is saved alongside the encrypted data for later decryption).

Step-by-Step Solution

Determine the operational mechanism of envelope encryption for large files.

Envelope encryption requires generating a temporary symmetric data key that will be used to encrypt the payload locally.

Direct encryption using KMS keys is limited to payloads of

4\text{ KB}

or less, meaning a

10\text{ MB}

file must be encrypted using envelope encryption.

Analyze the output of the GenerateDataKey API operation.

The GenerateDataKey operation creates a unique data key, encrypts it under the customer managed key, and returns both the plaintext key and the encrypted ciphertext key.

The application needs the plaintext key to encrypt the file immediately, and the ciphertext key to save next to the encrypted file so it can be decrypted later.

Match the generated API outputs to the options provided.

The option stating that both the plaintext data key and the encrypted ciphertext data key are returned is correct.

It matches the exact response schema of the GenerateDataKey API call.

Key Concept

AWS KMS Envelope Encryption Workflow

Estimated Time:45s

Question 191Question →

An application hosted on Amazon EC2 instances requires access to a database password that must be rotated every 30 days, as well as a non-sensitive external API endpoint URL that does not change. Which TWO of the following configurations should the developer use to manage these values securely and cost-effectively? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager and configure automatic rotation.

Store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter.

Store the database password in Systems Manager Parameter Store, as Parameter Store natively supports automatic rotation of database credentials.

Hardcode the database password directly within the application's SDK client initialization code.

Store the API endpoint URL in AWS Secrets Manager to utilize Secrets Manager's automatic rotation feature for static endpoints.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation.; Store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter.

Answer

Store the database password in AWS Secrets Manager and configure automatic rotation, and store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter.

The correct options are to store the database password in AWS Secrets Manager and configure automatic rotation, and store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter. This ensures sensitive passwords are encrypted and rotated automatically, while non-sensitive parameters are stored cost-effectively in Parameter Store without incurring extra charges.

Step-by-Step Solution

Analyze the requirements for the database password.

The database password is a sensitive credential and requires rotation every 30 days.

AWS Secrets Manager is the optimal service because it securely stores secrets and provides built-in rotation integration.

Analyze the requirements for the API endpoint URL.

The API endpoint URL is non-sensitive and static (does not change or rotate).

Systems Manager Parameter Store is the most cost-effective solution for non-sensitive configuration parameters.

Key Concept

Distinction between AWS Secrets Manager and Systems Manager Parameter Store

Estimated Time:1m 0s

Question 192Question →

A developer is building a document archiving application where PDF files of approximately $5\text{ MB}$ each must be encrypted on the client side before they are uploaded to an Amazon S3 bucket. The encryption must be performed using an AWS KMS customer managed key. Which two steps must the developer perform to implement this encryption process? (Select two.)

Select all that apply

Call the GenerateDataKey API operation using the customer managed key identifier to receive a plaintext data key and an encrypted data key.

Encrypt the PDF file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted PDF along with the encrypted data key to Amazon S3.

Call the Encrypt API operation directly, passing the entire

5\text{ MB}

PDF file as the plaintext payload to be encrypted by the customer managed key.

Call the GenerateDataKeyWithoutPlaintext API operation to obtain the encrypted data key, and use the encrypted data key directly to perform symmetric encryption on the PDF file.

Call the GetPublicKey API operation to download the private key material of the customer managed key to perform local symmetric encryption.

Show answer & explanation

Answer: Call the GenerateDataKey API operation using the customer managed key identifier to receive a plaintext data key and an encrypted data key.; Encrypt the PDF file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted PDF along with the encrypted data key to Amazon S3.

Answer

The developer must call the GenerateDataKey API operation to retrieve both the plaintext and encrypted data keys, encrypt the PDF locally with the plaintext data key, delete the plaintext data key from memory, and then upload the encrypted PDF and the encrypted data key to Amazon S3.

For files larger than

4\text{ KB}

, direct encryption via AWS KMS is not possible due to size limitations. Instead, client-side envelope encryption must be used. Under this model, the developer calls the GenerateDataKey API operation to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the

5\text{ MB}

file locally, after which the plaintext key is deleted from memory to maintain security. Finally, the encrypted PDF and the encrypted data key are uploaded together to Amazon S3 so that the file can be decrypted in the future using the Decrypt API on the encrypted data key.

Step-by-Step Solution

Request a data key from KMS by calling GenerateDataKey.

The application receives a plaintext data key and an encrypted data key.

Because files larger than

4\text{ KB}

cannot be directly encrypted using the KMS Encrypt API, client-side envelope encryption is required.

Encrypt the

5\text{ MB}

PDF locally using a symmetric encryption algorithm (such as AES-256) with the plaintext data key.

The PDF file is converted into ciphertext.

The plaintext data key is needed by the local encryption library to encrypt the raw file payload.

Erase the plaintext data key from memory, and upload the ciphertext PDF and the encrypted data key to Amazon S3.

The encrypted file and its metadata (the encrypted data key) are securely stored in S3, and no plaintext key remains in the application's memory.

Removing the plaintext data key minimizes the window of exposure, and storing the encrypted data key with the ciphertext is necessary for later decryption.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 193Question →

A developer is designing service-to-service communication between a microservice running on Amazon ECS in AWS Account A and a private REST API hosted on Amazon API Gateway in AWS Account B. The API Gateway endpoint must restrict access to only allow requests originating from the ECS microservice in Account A. The security architecture must adhere to the principle of least privilege and minimize custom code development. Which of the following configurations should the developer implement to meet these requirements?

Configure the API Gateway method to use AWS_IAM authorization. Apply a resource policy to the API Gateway REST API in Account B that grants execute-api:Invoke permission to the specific ECS task IAM role in Account A. Configure the ECS microservice code to sign HTTP requests with Signature Version 4 (SigV4).

Create a custom Lambda authorizer in Account B. Configure the ECS task in Account A to obtain temporary security credentials from AWS Security Token Service (STS) in Account B, and pass the credentials in the Authorization header to the custom authorizer for manual signature verification.

Configure a Cognito User Pool authorizer on the API Gateway in Account B. Configure the ECS task in Account A to authenticate directly with an Amazon Cognito identity pool in Account B to obtain an ID token, and pass this token in the Authorization header.

Configure the API Gateway method to use Lambda Proxy integration with no authorizer. In the backend Lambda function, extract the caller's ECS task execution IAM role from the request context headers and return a 403 Forbidden response if the role does not match.

Show answer & explanation

Answer: Configure the API Gateway method to use AWS_IAM authorization. Apply a resource policy to the API Gateway REST API in Account B that grants execute-api:Invoke permission to the specific ECS task IAM role in Account A. Configure the ECS microservice code to sign HTTP requests with Signature Version 4 (SigV4).

Answer

The correct configuration provides the most secure and operationally efficient mechanism by using API Gateway's native AWS_IAM authorization. By configuring an API Gateway resource policy, the developer can explicitly grant access to the IAM role associated with the ECS task in the external account. Since the client request must be signed, Signature Version 4 (SigV4) protocol ensures authentication and integrity of the request payload without requiring custom token management or custom Lambda authorizer code.

Step-by-Step Solution

Enable AWS_IAM authorization on the API Gateway REST API resource methods in Account B.

This enforces IAM-based authentication and authorization at the API Gateway level before any backend services are invoked.

To natively authenticate requests using IAM identity credentials without writing custom authorization code.

Configure the API Gateway resource policy in Account B to allow the execute-api:Invoke action, specifying the ARN of the ECS task IAM role from Account A as the Principal.

This establishes cross-account permission, allowing the specific ECS container identity to access the private API Gateway REST API.

To adhere to the principle of least privilege by restricting access to only the specific identity requiring it.

Implement Signature Version 4 (SigV4) signing in the ECS microservice application code for outgoing HTTP requests to API Gateway.

Requests are securely signed with temporary AWS credentials from the ECS task IAM role, enabling API Gateway to verify the sender's identity.

To satisfy API Gateway's requirement for SigV4-signed requests when using AWS_IAM authorization.

Key Concept

Cross-account service-to-service authentication using API Gateway AWS_IAM authorization and Resource Policies.

Estimated Time:1m 30s

Question 194Question →

A developer is building a serverless order processing system using AWS Lambda and Amazon DynamoDB. The system must encrypt order payloads (each approximately $15\text{ KB}$ ) prior to saving them to DynamoDB. The developer implements envelope encryption using an AWS KMS customer managed key.

During order creation, the Lambda function calls the `GenerateDataKey` API operation, providing an `EncryptionContext` containing `{"OrderID": "ord-8831", "CustomerID": "cust-4402"}`. The application encrypts the order payload using the returned plaintext data key, discards the plaintext key, and saves the ciphertext order payload and the encrypted data key in DynamoDB.

When retrieving and decrypting the order, which approach must the Lambda function use to successfully obtain the plaintext order payload?

Call the KMS `Decrypt` API operation passing the ciphertext order payload and the `EncryptionContext` map directly to retrieve the decrypted order payload.

Call the Systems Manager Parameter Store `GetParameter` API operation, passing the OrderID to retrieve the cached plaintext data key associated with the encryption context.

Call the KMS `Decrypt` API operation passing the encrypted data key and the exact same `EncryptionContext` map, then use the returned plaintext data key to decrypt the order payload locally.

Call the KMS `Decrypt` API operation passing only the encrypted data key. The encryption context is metadata stored within the encrypted data key and is validated automatically by AWS KMS without requiring client input.

Show answer & explanation

Answer: Call the KMS `Decrypt` API operation passing the encrypted data key and the exact same `EncryptionContext` map, then use the returned plaintext data key to decrypt the order payload locally.

Answer

The Lambda function must call the KMS `Decrypt` API operation passing the encrypted data key and the exact same `EncryptionContext` map, then use the returned plaintext data key to decrypt the order payload locally.

The correct answer correctly identifies the envelope decryption process: calling the KMS `Decrypt` API with the encrypted data key and the exact same `EncryptionContext` map. The encryption context is cryptographically bound to the ciphertext, so supplying the exact matching key-value pairs is necessary for AWS KMS to successfully authenticate and decrypt the data key. Once the plaintext data key is returned, the client performs the actual payload decryption locally.

Step-by-Step Solution

Retrieve the encrypted data key and the ciphertext order payload from DynamoDB.

The Lambda function has the encrypted data key and the encrypted payload.

These components are required for the decryption process.

Call the AWS KMS `Decrypt` API, passing the encrypted data key and the exact encryption context `{"OrderID": "ord-8831", "CustomerID": "cust-4402"}`.

AWS KMS decrypts the data key and returns the plaintext data key.

Since the encryption context was provided during key generation, the same context is required to decrypt the key.

Use the plaintext data key to decrypt the

15\text{ KB}

order payload locally using symmetric decryption.

The plaintext order payload is obtained.

Envelope encryption requires the actual data decryption to happen on the client side using the decrypted data key.

Key Concept

AWS KMS Envelope Decryption with Encryption Context

Estimated Time:2m 0s

Question 195Question →

A developer is writing a local utility to back up database exports to Amazon S3. The compliance policy requires the developer to use client-side envelope encryption with an AWS KMS customer managed key to secure the files before they are uploaded. Which of the following actions must the developer perform to encrypt the files locally using client-side envelope encryption? (Select TWO.)

Select all that apply

Call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key.

Encrypt the database exports locally using the plaintext data key, and then securely discard the plaintext data key from memory.

Send the database export files directly to the AWS KMS Encrypt API operation to perform the encryption.

Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation to obtain the plaintext key needed to encrypt the files.

Retrieve a plaintext data key dynamically from the AWS Systems Manager Parameter Store as a SecureString parameter to encrypt the local files.

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key.; Encrypt the database exports locally using the plaintext data key, and then securely discard the plaintext data key from memory.

Answer

The developer must call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key, encrypt the database exports locally using the plaintext data key, and then securely discard the plaintext key from memory.

In client-side envelope encryption, the developer must first call the GenerateDataKey API operation using an AWS KMS customer managed key (CMK). This operation returns both a plaintext data key (used to encrypt the file locally) and an encrypted copy of the data key (stored alongside the encrypted data). Once the files are encrypted locally, the plaintext data key must be securely deleted from memory to maintain security.

Step-by-Step Solution

Request a data key from AWS KMS.

The GenerateDataKey API operation returns a plaintext data key and an encrypted version of that key.

This starts the client-side envelope encryption process by providing the key material required for local encryption.

Encrypt the files locally.

The local database exports are encrypted using the plaintext data key.

This performs the actual cryptographic operation on the client side, keeping the data secure before transport.

Clean up the plaintext key material.

The plaintext data key is discarded from memory.

To prevent unauthorized access to the encryption key, the plaintext key must not be persisted or left in memory.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 196Question →

A developer at a financial technology company is designing a REST API using Amazon API Gateway. The API must validate custom bearer tokens generated by a legacy, proprietary on-premises authorization server. The validation process requires invoking a custom decryption library and checking a local revocation list. Once authorized, the backend Lambda function needs to receive the user's subscription tier, which is extracted during token validation, to return the appropriate level of data. Which two actions must the developer take to implement this security and integration flow? (Select TWO.)

Select all that apply

Implement an API Gateway Lambda authorizer that validates the custom bearer token and returns an IAM policy along with a context map containing the subscription tier.

Use Lambda proxy integration for the backend integration, and retrieve the subscription tier in the backend Lambda function from the event.requestContext.authorizer object.

Configure an Amazon Cognito User Pool authorizer and configure it to perform active verification against the on-premises revocation list.

Configure an Amazon Cognito Identity Pool to validate the legacy bearer tokens and pass the subscription tier as a session tag during the STS assume role call.

Configure a Lambda custom integration and write a custom mapping template that reads the bearer token from the header, runs a helper utility inside the template to validate the token, and injects the subscription tier into the payload.

Show answer & explanation

Answer: Implement an API Gateway Lambda authorizer that validates the custom bearer token and returns an IAM policy along with a context map containing the subscription tier.; Use Lambda proxy integration for the backend integration, and retrieve the subscription tier in the backend Lambda function from the event.requestContext.authorizer object.

Answer

Implement an API Gateway Lambda authorizer to validate the token and return the subscription tier in the context map, and use Lambda proxy integration to retrieve the subscription tier in the backend Lambda function from the event.requestContext.authorizer object.

To authenticate legacy proprietary tokens requiring custom decryption and revocation checks, the developer must implement a Lambda authorizer. The Lambda authorizer validates the token and returns a JSON payload containing an IAM policy and a context map containing the user's subscription tier. When using Lambda proxy integration, API Gateway maps the context variables to the requestContext object, making them accessible in the backend Lambda function via the event structure under the authorizer property.

Step-by-Step Solution

Select the correct authorizer type.

Since the validation requires custom validation logic (decryption libraries and revocation checks), standard Cognito User Pool authorizers are not suitable. A Lambda authorizer must be configured.

Lambda authorizers execute a custom Lambda function to perform bearer token validation.

Pass context information from the authorizer.

The Lambda authorizer returns an IAM policy along with a key-value 'context' block containing the subscription tier.

The authorizer can inject string, number, or boolean values into the request context for downstream consumption.

Retrieve context in the backend integration.

By using Lambda proxy integration, the backend Lambda function receives the API Gateway request context containing the authorizer's context map directly in the event parameter under event.requestContext.authorizer.

This allows the backend function to dynamically adapt its behavior based on the subscription tier without re-validating the token.

Key Concept

Custom Lambda authorizers are used for validating non-Cognito tokens and passing custom context to backend integrations via the request context.

Estimated Time:2m 0s

Question 197Question →

A developer is implementing client-side envelope encryption to secure proprietary application log files, each approximately $8\text{ MB}$ in size, before archiving them to an Amazon S3 bucket. The developer wants to minimize both network latency and KMS API costs while ensuring the application principal adheres to the principle of least privilege. Which two actions must the developer perform to successfully implement the encryption phase of this workflow?

Select all that apply

Grant the application's IAM role permissions for the `kms:GenerateDataKey` action, but do not grant permissions for the `kms:Encrypt` action.

Call the `GenerateDataKey` API operation, encrypt the log file client-side using the returned plaintext data key, and then save both the encrypted log file and the encrypted data key to Amazon S3.

Call the `GenerateDataKeyWithoutPlaintext` API operation to retrieve the encrypted data key, use it directly to encrypt the log file, and discard the key.

Grant the application's IAM role permissions for the `kms:Encrypt` action, and call the `Encrypt` API operation for each log file to secure the payload before uploading to S3.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter, using the log file's S3 object key as the parameter name.

Show answer & explanation

Answer: Grant the application's IAM role permissions for the `kms:GenerateDataKey` action, but do not grant permissions for the `kms:Encrypt` action.; Call the `GenerateDataKey` API operation, encrypt the log file client-side using the returned plaintext data key, and then save both the encrypted log file and the encrypted data key to Amazon S3.

Answer

Grant the application's IAM role permissions for the `kms:GenerateDataKey` action (excluding `kms:Encrypt`) and call the `GenerateDataKey` API operation, using the returned plaintext data key to encrypt the log file locally before saving the encrypted log and the encrypted data key to Amazon S3.

The correct configuration requires calling the `GenerateDataKey` API operation, which returns both the plaintext data key (used for local symmetric encryption of the

8\text{ MB}

file) and the ciphertext data key (stored with the encrypted file in S3). Because the encryption is performed locally by the application rather than by the KMS service, the application's IAM role only requires `kms:GenerateDataKey` permission and does not need `kms:Encrypt` permission.

Step-by-Step Solution

Determine key size and encryption method.

Since the log files are

8\text{ MB}

(which exceeds the KMS direct encryption limit of

4\text{ KB}

), client-side envelope encryption must be used.

KMS direct encryption API is restricted to small payloads; envelope encryption resolves this by performing encryption locally using a data key.

Configure IAM permissions for the application role.

Grant `kms:GenerateDataKey` permission. Do not grant `kms:Encrypt`.

Least privilege requires only the permissions necessary to generate the data key. The encryption is done locally, so KMS `Encrypt` is not utilized.

Request a data key from AWS KMS.

The application calls the `GenerateDataKey` API and receives a plaintext data key and a ciphertext data key.

The plaintext key is required for local encryption, and the ciphertext key is stored for future decryption.

Perform local encryption and storage.

Encrypt the log file using the plaintext data key, securely wipe the plaintext key from memory, and upload both the encrypted log file and the ciphertext data key to S3.

This completes the envelope encryption workflow, ensuring plaintext keys are not exposed or persisted.

Key Concept

AWS KMS client-side envelope encryption workflow and IAM privilege separation

Question 198Question →

A developer is implementing a database maintenance task using an AWS Lambda function. The function is configured to run within a private subnet of a custom VPC in order to access an Amazon RDS DB instance. The database credentials must be retrieved securely from AWS Secrets Manager. During testing, the Lambda function successfully queries the database but fails when trying to retrieve credentials from the Secrets Manager endpoint. Which action should the developer take to resolve this connection failure?

Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.

Associate the Lambda function with the VPC's public subnets to allow direct outbound access to the public Secrets Manager endpoint without requiring a NAT Gateway or VPC endpoints.

Update the Lambda function's execution role to include an IAM trust policy that explicitly grants assume role permissions to the VPC's security groups.

Move the database credentials from Secrets Manager to Systems Manager Parameter Store, which is natively reachable from private VPC subnets without VPC endpoints or internet connectivity.

Show answer & explanation

Answer: Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.

Answer

Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.

Creating an interface VPC endpoint for Secrets Manager allows resources in private subnets to securely connect to the service via PrivateLink, avoiding the public internet. The security group of the Lambda function must allow outbound HTTPS traffic to the endpoint's IP addresses to establish this connection.

Step-by-Step Solution

Analyze the network path requirements.

The Lambda function is running in a private VPC subnet and needs to access AWS Secrets Manager, which is a public service.

Since the VPC lacks a NAT Gateway or internet path, the function cannot reach public endpoints.

Select the correct VPC security integration pattern.

Create an interface VPC endpoint (powered by AWS PrivateLink) for Secrets Manager inside the VPC.

This provides a private network path from the VPC subnets to the AWS service using private IP addresses.

Configure the security groups.

Allow outbound traffic from the Lambda function's security group to the VPC endpoint on HTTPS port 443.

Security groups are stateful and must allow outbound connections to initiate the handshake.

Key Concept

VPC Endpoint integration for accessing public AWS services privately from within private subnets.

Question 199Question →

A developer is writing a Java application that needs to encrypt a database export file of $50\text{ MB}$ before uploading it to Amazon S3. The security policy requires client-side envelope encryption using an AWS KMS customer managed key. Which AWS KMS API operation should the developer use to obtain the necessary data key to encrypt this file locally?

GenerateDataKey

Encrypt

GenerateDataKeyWithoutPlaintext

GetParametersByPath

Show answer & explanation

Answer: GenerateDataKey

Answer

GenerateDataKey

The correct answer is the GenerateDataKey operation. In client-side envelope encryption, the application calls GenerateDataKey, which generates a unique symmetric data key under the specified customer managed key. KMS returns both the plaintext key (which the Java application uses to encrypt the

50\text{ MB}

file locally) and the encrypted version of that same data key (which is uploaded to Amazon S3 alongside the encrypted file).

Step-by-Step Solution

Determine the encryption method based on file size.

Since the file size (

50\text{ MB}

) is much larger than the

4\text{ KB}

payload limit for direct AWS KMS encryption, the developer must use client-side envelope encryption.

AWS KMS is not designed to encrypt large datasets directly.

Identify the KMS API required to generate a local data key.

The application needs to generate a unique data key under the specified customer managed key, receiving both the plaintext version (to perform the encryption) and the ciphertext version (to package with the encrypted file).

Envelope encryption requires a local symmetric data key to perform the actual data encryption.

Select the correct KMS API operation.

The GenerateDataKey operation is the standard API designed for envelope encryption workflows to return both the plaintext and encrypted data keys.

This avoids unnecessary Decrypt calls that would be required if using GenerateDataKeyWithoutPlaintext.

Key Concept

AWS KMS Envelope Encryption and Data Key Generation

Question 200Question →

A developer is building a containerized application running on Amazon ECS. The application must encrypt application log archives of approximately $12\text{ MB}$ each on the client side before uploading them to an Amazon S3 bucket. The developer wants to use a customer managed key in AWS KMS.

Which of the following steps are required to implement this client-side envelope encryption workflow? (Select TWO.)

Select all that apply

Call the GenerateDataKey API operation to receive both a plaintext data key and an encrypted copy of the data key.

Encrypt the log archive locally using the plaintext data key, then immediately remove the plaintext data key from the application's memory.

Call the Encrypt API operation directly, passing the entire

12\text{ MB}

log archive as the plaintext parameter.

Call the GenerateDataKeyWithoutPlaintext API operation, and use the customer managed key's public key to encrypt the log archive.

Store the plaintext data key in AWS Systems Manager Parameter Store with secure string parameters for future decryption processes.

Show answer & explanation

Answer: Call the GenerateDataKey API operation to receive both a plaintext data key and an encrypted copy of the data key.; Encrypt the log archive locally using the plaintext data key, then immediately remove the plaintext data key from the application's memory.

Answer

To perform client-side envelope encryption for files larger than

4\text{ KB}

, the developer must call the GenerateDataKey API operation to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the files locally and must be destroyed from memory immediately after use. The encrypted data key is stored alongside the encrypted files for future decryption.

The correct steps to implement client-side envelope encryption are to call the GenerateDataKey API operation to retrieve both the plaintext and encrypted data keys, encrypt the data locally with the plaintext key, and then delete the plaintext key from memory. This complies with security best practices and allows the encryption of files larger than the

4\text{ KB}

KMS direct encryption limit.

Step-by-Step Solution

Generate the data keys by calling AWS KMS.

The GenerateDataKey API returns a plaintext data key and a ciphertext (encrypted) data key.

A plaintext key is needed to perform the encryption algorithm locally, and the encrypted version is needed to store with the data for later decryption.

Encrypt the file locally and clean up memory.

The

12\text{ MB}

log archive is encrypted using the plaintext data key, and the plaintext data key is discarded from memory.

Local encryption avoids the

4\text{ KB}

KMS API limit, and deleting the plaintext key from memory minimizes the risk of key exposure.

Key Concept

AWS KMS Envelope Encryption Workflow

PreviousPage 10 / 20Next

Security

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept