AWS KMS and Encryption

82 questions

All types82 Multiple choice42 Multiple select40

A developer is building a document processing application that must secure sensitive PDF documents before uploading them to a third-party storage service. The average size of each document is $15\text{ MB}$ . To meet security requirements, the developer must encrypt the documents client-side using an AWS KMS Customer Managed Key (CMK) while minimizing latency and network overhead. Which approach should the developer implement to encrypt these documents securely and efficiently?

Call the KMS Encrypt API directly, passing the raw document binary as the plaintext parameter along with the CMK ARN, and store the returned ciphertext.

Call the KMS GenerateDataKey API with the CMK to obtain a plaintext data key and an encrypted data key. Encrypt the document locally using the plaintext data key, delete the plaintext key from memory, and store the encrypted data key alongside the encrypted document.

Call the KMS GenerateDataKeyWithoutPlaintext API to retrieve an encrypted data key. Send the encrypted data key to the KMS Decrypt API to get the plaintext key, encrypt the document locally, and store the encrypted data key with the document.

Retrieve a pre-generated symmetric key stored in AWS Systems Manager Parameter Store as a SecureString parameter using the GetParameter API. Encrypt the document locally with this key and discard the retrieved parameter value.

Show answer & explanation

Answer: Call the KMS GenerateDataKey API with the CMK to obtain a plaintext data key and an encrypted data key. Encrypt the document locally using the plaintext data key, delete the plaintext key from memory, and store the encrypted data key alongside the encrypted document.

Answer

The correct approach is to call the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the document locally, and is then discarded from memory. The encrypted data key is stored alongside the encrypted document so that it can be decrypted later using the Decrypt API. This utilizes envelope encryption, which is necessary because the documents exceed the size limit of the direct KMS Encrypt API.

Step-by-Step Solution

Evaluate the file size (

15\text{ MB}

) against AWS KMS direct encryption payload limits.

Since the direct KMS Encrypt API has a strict limit of

4\text{ KB}

, direct encryption is not possible. Envelope encryption must be used.

To select the appropriate KMS workflow based on payload size constraints.

Determine the most efficient API call for obtaining data keys for client-side envelope encryption.

GenerateDataKey returns both the plaintext key (for local encryption) and the encrypted key (for storage) in a single network request.

To minimize latency and network calls during document upload processing.

Validate security best practices for handling the generated plaintext data key.

Once the document is encrypted locally with the plaintext key, the plaintext key is deleted from application memory, and the encrypted key is packaged with the ciphertext.

To ensure the plaintext key is not exposed or leaked.

Key Concept

Client-side envelope encryption workflow using AWS KMS GenerateDataKey API

Estimated Time:2m 0s

Question 2Question →

An application running on AWS Fargate generates monthly audit reports (each approximately $8\text{ MB}$ in size) that must be encrypted client-side before they are stored in an external third-party storage system. The developer wants to use AWS Key Management Service (AWS KMS) with a customer managed key to secure these reports.

Which of the following actions must the developer take to implement this client-side encryption workflow? (Select TWO.)

Select all that apply

Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.

Call the Encrypt API of AWS KMS to encrypt the audit report directly.

Call the GenerateDataKeyWithoutPlaintext API of AWS KMS to obtain an encrypted data key, and use it to encrypt the audit report locally.

Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString to reuse it for subsequent audit reports.

Show answer & explanation

Answer: Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.; Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.

Answer

To encrypt a file larger than

4\text{ KB}

client-side, the developer must generate a data key by calling the GenerateDataKey API, use the returned plaintext data key to encrypt the report locally, discard the plaintext key from memory, and store the encrypted data key alongside the encrypted audit report.

To encrypt a large file client-side using AWS KMS, the developer must implement envelope encryption. This involves calling the GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the audit report locally, after which the plaintext key is discarded from memory. The encrypted data key is then stored with the encrypted report so that it can be decrypted later by calling the Decrypt API to recover the plaintext key.

Step-by-Step Solution

Generate a unique data key.

The GenerateDataKey API is called, which returns a plaintext data key and an encrypted data key.

Since the file exceeds the direct encryption limit of AWS KMS, envelope encryption is required. The plaintext key is needed to perform the encryption, and the encrypted key is saved for future decryption.

Encrypt the data locally.

The Fargate container encrypts the

8\text{ MB}

report using the plaintext data key.

This performs the actual cryptographic operation locally without sending the large file to AWS KMS.

Clean up memory and store metadata.

The plaintext key is cleared from the container's memory, and the encrypted data key is written alongside the encrypted report.

Holding the plaintext key longer than necessary in memory presents a security risk, and the encrypted data key is the only way to recover the plaintext key during decryption.

Key Concept

AWS KMS client-side envelope encryption workflow for objects exceeding the direct encryption size limits.

Question 3Question →

A developer is designing a microservice that processes sensitive transaction payloads of approximately $1.5\text{ MB}$ each. The microservice must encrypt these payloads before storing them in an on-premises database. The encryption keys must be managed in AWS KMS. Which approach should the developer use to perform the encryption in a secure and efficient manner?

Call the Encrypt API operation directly, passing the payload and the customer managed key identifier, then store the resulting ciphertext in the database.

Store the transaction payloads directly in AWS Systems Manager Parameter Store as SecureString parameters, configuring Parameter Store to use the KMS customer managed key for encryption.

Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.

Call the GenerateDataKeyWithoutPlaintext API operation to obtain an encrypted data key. Decrypt the key locally using a client-side cryptographic library, use it to encrypt the payload, and discard the key.

Show answer & explanation

Answer: Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.

Answer

For data larger than

4\text{ KB}

, developers must use envelope encryption. Calling the GenerateDataKey API provides a plaintext data key to perform local symmetric encryption of the

1.5\text{ MB}

payload and an encrypted copy of the data key. Once encryption is complete, the plaintext data key is discarded from memory, and the encrypted payload is stored alongside the encrypted data key. The encrypted data key can later be sent to KMS Decrypt to retrieve the plaintext key for decryption.

Step-by-Step Solution

Identify the size limit of the direct KMS Encrypt API and compare it to the transaction payload size.

The transaction payload is

1.5\text{ MB}

, which exceeds the

4\text{ KB}

limit of the direct KMS Encrypt API.

KMS direct encryption cannot process payloads larger than

4\text{ KB}

, requiring the use of envelope encryption.

Evaluate the options for envelope encryption using AWS KMS APIs.

Calling GenerateDataKey provides both the plaintext data key for local encryption and the encrypted data key for storage.

GenerateDataKey generates the keys locally without transmitting the actual data payload to KMS, which is highly efficient.

Complete the envelope encryption workflow locally on the client.

The plaintext key encrypts the payload, is removed from memory, and the encrypted payload is stored with the encrypted data key.

This ensures the plaintext key is not exposed and the data can be decrypted later by decrypting the data key with KMS.

Key Concept

KMS Envelope Encryption and API Limits

Question 4Question →

An application running on Amazon ECS container instances in Account A needs to decrypt sensitive data files stored in an Amazon S3 bucket. The files are encrypted using an AWS KMS Customer Managed Key (CMK) located in Account B. The developer needs to configure the permissions to allow the application to decrypt these files.

Which of the following actions must be taken to grant the application the required permissions? (Choose two.)

Select all that apply

In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A.

In Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

In Account A, attach an IAM policy to the ECS task execution role that allows the kms:Decrypt action on the KMS key ARN in Account B.

In Account B, update the S3 bucket policy to grant kms:Decrypt permissions to the application's IAM task role in Account A.

In Account A, retrieve the KMS Customer Managed Key plaintext key material and store it as a SecureString in AWS Systems Manager Parameter Store.

Show answer & explanation

Answer: In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A.; In Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

Answer

In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A; and in Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

Cross-account access to KMS keys requires validation at both the resource level and the identity level. First, the key policy of the Customer Managed Key in Account B must be configured to trust the external account or role. Second, the IAM policy in the application's account (Account A) must grant the application's IAM role permission to call the KMS API. Because the application logic runs within ECS containers, these permissions must be applied to the ECS Task Role.

Step-by-Step Solution

Differentiate between the ECS task role and the ECS task execution role.

Identify that the application container uses the ECS Task Role for application-level AWS API calls (such as KMS decryption), whereas the Task Execution Role is for container agent operations.

This prevents assigning permissions to the wrong IAM role.

Configure the key-level permissions in the KMS key owner's account (Account B).

Update the KMS key policy in Account B to delegate decrypt permissions to the IAM task role ARN from Account A.

AWS KMS requires the key policy to explicitly allow cross-account access, as identity-based IAM policies in the external account are not sufficient on their own.

Configure the identity-level permissions in the application's account (Account A).

Attach an IAM policy to the ECS Task Role in Account A allowing the kms:Decrypt action on the target KMS key ARN.

For cross-account access, permissions must be allowed on both the resource policy (key policy) and the identity policy (IAM policy).

Key Concept

Cross-Account KMS Key Access and ECS Task Roles

Estimated Time:2m 0s

Question 5Question →

A developer is designing a serverless backend using AWS Lambda that processes sensitive customer records. Each record contains a profile payload averaging $15$ KB in size. The application must encrypt these payloads before storing them in an Amazon DynamoDB table. To meet strict performance and cost-efficiency requirements, the developer must implement client-side envelope encryption using a Customer Managed Key (CMK) managed by AWS KMS. Which of the following application workflows represents the most secure, cost-effective, and architecturally correct implementation of client-side envelope encryption?

Call the KMS Encrypt API directly, passing the

15

KB customer record as the plaintext payload. Store the returned ciphertext blob directly in the DynamoDB table.

Generate a symmetric key locally in the Lambda function, encrypt the customer record with it, and call the KMS Encrypt API to encrypt the local key. Store the encrypted record in DynamoDB, and store the encrypted symmetric key in AWS Secrets Manager using a unique secret per customer record.

Call the KMS GenerateDataKeyWithoutPlaintext API to retrieve an encrypted data key. Store this key in Systems Manager Parameter Store, and then call the KMS Decrypt API within the Lambda function to get the plaintext key to encrypt the payload.

Call the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. Encrypt the customer record payload locally using the plaintext data key, delete the plaintext data key from memory, and store the encrypted payload and the encrypted data key together in the DynamoDB item.

Show answer & explanation

Answer: Call the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. Encrypt the customer record payload locally using the plaintext data key, delete the plaintext data key from memory, and store the encrypted payload and the encrypted data key together in the DynamoDB item.

Answer

The correct workflow calls the KMS GenerateDataKey API to obtain both the plaintext data key and the encrypted data key in a single request. The plaintext key is used locally to encrypt the payload and then immediately cleared from memory, while the encrypted data key is stored directly alongside the encrypted payload in the DynamoDB table.

The correct workflow uses the GenerateDataKey API, which yields both a plaintext data key and an encrypted data key in a single request. The plaintext key is used locally to encrypt the payload and then immediately cleared from memory, while the encrypted data key is stored directly alongside the encrypted payload in the DynamoDB table. This implements client-side envelope encryption securely and efficiently, bypassing the

4

KB size limit of the Encrypt API without introducing unnecessary API calls or storage overhead.

Step-by-Step Solution

Evaluate the payload size and KMS constraints.

The record size of

15

KB exceeds the

4

KB direct encryption limit of the KMS Encrypt API, indicating envelope encryption is required.

To determine if direct KMS encryption is a viable or correct option.

Analyze key generation and retrieval efficiency.

Using GenerateDataKey provides both the plaintext key (for immediate encryption) and the ciphertext key in a single API call, whereas GenerateDataKeyWithoutPlaintext would require a second Decrypt API call.

To minimize KMS API costs and latency.

Determine the storage location for the encrypted data key.

The encrypted data key should be stored directly alongside the encrypted payload in the DynamoDB item, rather than external systems like Secrets Manager or Parameter Store.

To avoid external resource overhead, scale efficiently, and follow proper envelope encryption architecture.

Key Concept

AWS KMS Envelope Encryption Workflow

Estimated Time:3m 0s

Question 6Question →

A developer is building a high-security microservice that processes sensitive transaction payloads. The application uses client-side envelope encryption with an AWS KMS customer managed key. The developer must ensure that:

1. The encrypted transaction payloads are cryptographically bound to a specific $TransactionID$ and $VaultRegion$ to prevent decryption under any other context.
2. All cryptographic operations are logged in AWS CloudTrail with these context details for compliance auditing.

Which two actions must the developer take to implement this encryption workflow?

Select all that apply

Call the GenerateDataKey API with the EncryptionContext parameter containing the TransactionID and VaultRegion as key-value pairs.

Pass the identical EncryptionContext key-value pairs in the Decrypt API call when decrypting the encrypted data key.

Call the GenerateDataKey API without a context, and pass the TransactionID and VaultRegion only in the Decrypt API call to filter the decryption logs.

Save the TransactionID and VaultRegion as secure string parameters in AWS Systems Manager Parameter Store to automatically manage the decryption context.

Call the Encrypt API directly for the transaction payload and pass the EncryptionContext in the GrantTokens parameter to bypass policy checks.

Show answer & explanation

Answer: Call the GenerateDataKey API with the EncryptionContext parameter containing the TransactionID and VaultRegion as key-value pairs.; Pass the identical EncryptionContext key-value pairs in the Decrypt API call when decrypting the encrypted data key.

Answer

To implement this client-side envelope encryption workflow, the developer must call the GenerateDataKey API with the EncryptionContext parameter containing the TransactionID and VaultRegion as key-value pairs, and pass the identical EncryptionContext key-value pairs in the Decrypt API call when decrypting the encrypted data key.

The correct options describe the standard AWS KMS envelope encryption workflow using Encryption Context. The EncryptionContext parameter in the GenerateDataKey API call cryptographically binds the key-value pair metadata (TransactionID and VaultRegion) to the encrypted data key. During decryption, passing the identical EncryptionContext map is mandatory; otherwise, AWS KMS cannot decrypt the data key. Both calls are logged in AWS CloudTrail with the encryption context in plaintext.

Step-by-Step Solution

Generate a unique data key with context.

The application calls the GenerateDataKey API on AWS KMS, passing the Customer Managed Key ARN and an EncryptionContext map containing the TransactionID and VaultRegion.

This cryptographically binds the metadata to the encrypted version of the data key and records it in AWS CloudTrail.

Encrypt the payload locally.

The application uses the plaintext data key to encrypt the transaction payload locally, then discards the plaintext data key from memory.

This completes the client-side envelope encryption process safely without exposing the plaintext key.

Decrypt the data key using the identical context.

When decrypting the payload, the application calls the Decrypt API, passing the ciphertext data key and the identical EncryptionContext map.

AWS KMS validates the context against the cryptographic signature in the ciphertext. If they match, it returns the plaintext data key to decrypt the payload.

Key Concept

AWS KMS Encryption Context in Envelope Encryption

Question 7Question →

A developer is writing a backup utility that must encrypt database export files, each approximately $500\text{ MB}$ in size, before uploading them to an Amazon S3 bucket. The utility must use client-side envelope encryption with an AWS Key Management Service (AWS KMS) customer managed key.

Which two steps must the developer implement in the utility's code to encrypt the files securely and prepare them for storage?

Select all that apply

Call the AWS KMS GenerateDataKey API operation by passing the customer managed key identifier to obtain both a plaintext data key and a ciphertext data key.

Encrypt the database export file locally using the plaintext data key with a symmetric encryption algorithm, and then delete the plaintext data key from memory.

Call the AWS KMS Encrypt API operation by passing the database export file and the customer managed key identifier to obtain the encrypted ciphertext.

Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation to obtain the encrypted data key, and then call the AWS KMS Decrypt API operation to retrieve the plaintext data key.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter, and upload the encrypted database export file to the S3 bucket.

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API operation by passing the customer managed key identifier to obtain both a plaintext data key and a ciphertext data key.; Encrypt the database export file locally using the plaintext data key with a symmetric encryption algorithm, and then delete the plaintext data key from memory.

Answer

Call the AWS KMS GenerateDataKey API operation by passing the customer managed key identifier to obtain both a plaintext data key and a ciphertext data key, and encrypt the database export file locally using the plaintext data key with a symmetric encryption algorithm, and then delete the plaintext data key from memory.

The correct answer combines calling the AWS KMS GenerateDataKey API to retrieve both key formats and performing the symmetric encryption locally before deleting the plaintext key from memory. Since the database export file is

500\text{ MB}

, direct encryption via the AWS KMS Encrypt API is impossible due to its

4\text{ KB}

payload limit. Locally encrypting with the plaintext data key and then immediately destroying it ensures maximum security.

Step-by-Step Solution

Generate a unique data key pair using AWS KMS.

Obtained a plaintext data key and a ciphertext data key via the GenerateDataKey API call.

The file size (

500\text{ MB}

) exceeds the direct encryption payload limit of

4\text{ KB}

for AWS KMS, so envelope encryption must be initiated.

Encrypt the file locally.

The file is encrypted using a symmetric cipher (such as AES-GCM) with the plaintext data key.

Envelope encryption requires the actual data to be encrypted client-side using the generated plaintext data key.

Secure the encryption keys.

The plaintext data key is discarded from memory, and the ciphertext data key is saved for future decryption.

This prevents exposure of the plaintext key and allows future decryption by sending the ciphertext data key back to AWS KMS.

Key Concept

AWS KMS client-side envelope encryption workflow and payload limits

Question 8Question →

A developer is designing a serverless document management system where users upload sensitive documents of approximately $500\text{ KB}$ each. The application must perform client-side envelope encryption on these documents before uploading them to an Amazon S3 bucket. The developer wants to use an AWS KMS customer managed key for this process.

Which of the following actions must the developer perform to encrypt the documents and prepare them for storage? (Select TWO.)

Select all that apply

Call the KMS `GenerateDataKey` API with the customer managed key to retrieve a plaintext data key and a ciphertext data key.

Encrypt the document locally using the plaintext data key, upload the encrypted document and the ciphertext data key to Amazon S3, and delete the plaintext data key from memory.

Call the KMS `Encrypt` API directly to encrypt the document payload, as customer managed keys support direct payload encryption up to

5\text{ MB}

Call the KMS `GenerateDataKeyWithoutPlaintext` API to retrieve the ciphertext data key, and use it to encrypt the document locally before uploading it to Amazon S3.

Store the encrypted document in Amazon S3, and save the plaintext data key in AWS Systems Manager Parameter Store with secure string parameters for future decryption.

Show answer & explanation

Answer: Call the KMS `GenerateDataKey` API with the customer managed key to retrieve a plaintext data key and a ciphertext data key.; Encrypt the document locally using the plaintext data key, upload the encrypted document and the ciphertext data key to Amazon S3, and delete the plaintext data key from memory.

Answer

To perform client-side envelope encryption, the developer must call the KMS GenerateDataKey API to obtain both the plaintext and ciphertext data keys. The document is encrypted locally using the plaintext data key, and both the encrypted document and ciphertext data key are stored in S3, while the plaintext data key is discarded from memory.

To implement client-side envelope encryption, the developer needs to generate a unique data key using the customer managed key. The KMS GenerateDataKey API returns both the plaintext data key (for immediate encryption) and the ciphertext data key (for storage). The document is encrypted locally using the plaintext key. After encryption, the encrypted document and ciphertext data key are uploaded to S3, and the plaintext data key is discarded from memory to prevent unauthorized access.

Step-by-Step Solution

Generate a data key from AWS KMS.

A plaintext data key and a ciphertext data key are obtained using the GenerateDataKey API and the customer managed key.

The plaintext data key is needed for local encryption, and the ciphertext data key is needed to decrypt the document later.

Perform local client-side encryption.

The document payload is encrypted using the plaintext data key.

Local encryption keeps the plaintext data secure before it is transmitted to S3.

Store the encrypted artifacts and clean up memory.

The encrypted document and ciphertext data key are uploaded to S3, and the plaintext data key is removed from memory.

Storing the ciphertext data key alongside the document ensures it can be decrypted later by calling KMS Decrypt, while discarding the plaintext key minimizes exposure risk.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 9Question →

A developer needs to encrypt database backup files, each approximately $45\text{ MB}$ in size, before uploading them to an Amazon S3 bucket. The security policy requires client-side encryption using a customer managed key in AWS KMS. Which of the following actions must the developer perform to implement client-side envelope encryption for these files? (Select TWO.)

Select all that apply

Call the GenerateDataKey API operation, passing the KMS key identifier, to obtain a plaintext data key and an encrypted data key.

Encrypt the file locally using the plaintext data key, upload the encrypted file and the encrypted data key to Amazon S3, and then delete the plaintext data key from memory.

Call the Encrypt API operation directly, passing the KMS key identifier and the entire

45\text{ MB}

file payload.

Call the GenerateDataKeyWithoutPlaintext API operation to obtain the data key for local encryption of the backup files.

Configure AWS Systems Manager Parameter Store to automatically rotate the database credentials and generate a database backup key.

Show answer & explanation

Answer: Call the GenerateDataKey API operation, passing the KMS key identifier, to obtain a plaintext data key and an encrypted data key.; Encrypt the file locally using the plaintext data key, upload the encrypted file and the encrypted data key to Amazon S3, and then delete the plaintext data key from memory.

Answer

Call the GenerateDataKey API operation to obtain both a plaintext data key and an encrypted data key, encrypt the file locally using the plaintext key, and then delete the plaintext key from memory.

The correct options outline the standard KMS envelope encryption workflow. A developer calls the GenerateDataKey API operation to get both the plaintext key and the encrypted key. The plaintext key is used to encrypt the large payload locally, and then it is immediately deleted from memory. The encrypted data key is stored with the encrypted data for future decryption.

Step-by-Step Solution

Generate a unique data key using AWS KMS.

Obtained a plaintext data key and an encrypted version of the data key.

The developer must call GenerateDataKey. KMS returns both the plaintext key to encrypt the large data locally and the encrypted key to store alongside the data.

Encrypt the file locally and clean up the memory.

The file is securely encrypted using a symmetric algorithm, and the plaintext data key is removed from memory.

To prevent unauthorized access, the plaintext key is deleted immediately after the encryption is complete, leaving only the encrypted data and the encrypted key.

Key Concept

Envelope encryption involves generating a unique data key to encrypt large data payloads locally, then storing the encrypted data key alongside the encrypted data while discarding the plaintext key from memory.

Question 10Question →

A developer is designing a containerized microservice that runs on Amazon ECS. The microservice must store sensitive customer data in an Amazon DynamoDB table. Due to compliance requirements, the data must be encrypted client-side before it is sent to DynamoDB. The developer wants to use envelope encryption with an AWS KMS customer managed key to minimize KMS API calls and encrypt the data efficiently. Which two API operations must the developer implement in the microservice code to manage the keys for this client-side encryption and decryption workflow? (Select TWO.)

Select all that apply

kms:GenerateDataKey

kms:Decrypt

kms:GenerateDataKeyWithoutPlaintext

kms:Encrypt

ssm:GetParameter

Show answer & explanation

Answer: kms:GenerateDataKey; kms:Decrypt

Answer

The correct answer consists of the operations kms:GenerateDataKey and kms:Decrypt.

The correct operations are kms:GenerateDataKey and kms:Decrypt. In envelope encryption, the application calls kms:GenerateDataKey to obtain a plaintext data key (to encrypt the payload locally) and a ciphertext data key (to store alongside the encrypted payload). To decrypt the data, the application calls kms:Decrypt with the ciphertext data key to retrieve the plaintext data key, which is then used to decrypt the payload locally.

Step-by-Step Solution

Analyze the requirement for client-side envelope encryption and decryption of DynamoDB items using a customer managed key.

Identify that the application needs to dynamically generate a unique symmetric data key for each item, encrypt the payload locally, store the encrypted key with the item, and retrieve the plaintext key for decryption later.

This establishes the workflow where the KMS customer managed key is only used to protect the data keys, not the database payloads directly.

Determine the API operation required for the encryption phase.

Identify kms:GenerateDataKey as the API call that provides the plaintext key for immediate local encryption and the ciphertext key for storage.

Using kms:GenerateDataKeyWithoutPlaintext would require an additional round-trip to decrypt the key, and kms:Encrypt violates envelope encryption by sending the payload itself to KMS.

Determine the API operation required for the decryption phase.

Identify kms:Decrypt as the API call used to decrypt the stored ciphertext data key back to its plaintext form.

The microservice retrieves the ciphertext key from the DynamoDB item and must call kms:Decrypt before it can decrypt the customer data locally.

Key Concept

Envelope encryption workflow with AWS KMS

Estimated Time:1m 30s

Question 11Question →

A developer is designing a secure file upload utility for a containerized microservice. The utility must encrypt files up to $100\text{ MB}$ locally before uploading them to an Amazon S3 bucket named `my-app-data`. To comply with strict security and auditing guidelines, the solution must satisfy the following requirements:

1. Ensure that plaintext data keys are never persisted or stored in any AWS service.
2. Prevent unauthorized decryption if the encrypted files are copied to a different S3 bucket.
3. Minimize AWS KMS API calls to avoid rate-limiting/throttling and control costs.
4. Record all cryptographic key usage in AWS CloudTrail for auditing.

Which KMS API workflow and architecture meets these requirements?

Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned plaintext data key to encrypt the file locally using a symmetric encryption library, immediately delete the plaintext key from memory, and upload the encrypted file to S3 with the ciphertext data key stored in the object's user-defined metadata.

Call the KMS `GenerateDataKeyWithoutPlaintext` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned ciphertext data key to encrypt the file locally, then call the KMS `Decrypt` API to retrieve the plaintext key for validation before uploading the encrypted file to S3.

Divide each file into

4\text{ KB}

chunks. For each chunk, call the KMS `Encrypt` API using the Customer Managed Key (CMK) and passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Concatenate the resulting ciphertext chunks and upload the final encrypted payload to the S3 bucket.

Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK). Use the returned plaintext data key to encrypt the file locally. Store the plaintext data key in AWS Secrets Manager under a dynamic path like `/keys/my-app-data/data-key`, configure the secret to auto-delete after 15 minutes, and upload the encrypted file to S3.

Show answer & explanation

Answer: Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned plaintext data key to encrypt the file locally using a symmetric encryption library, immediately delete the plaintext key from memory, and upload the encrypted file to S3 with the ciphertext data key stored in the object's user-defined metadata.

Answer

The correct workflow uses `GenerateDataKey` with an `EncryptionContext` of the target bucket. This generates both the plaintext key (needed to perform the encryption locally) and the ciphertext key. The plaintext key is used to encrypt the payload and is immediately discarded. The ciphertext key is stored in the object's S3 metadata. Binding the bucket name via `EncryptionContext` ensures that if the object is copied to another bucket, decryption will fail because the context won't match the new bucket name.

Step-by-Step Solution

Request a data key from KMS with bucket context.

Receive both a plaintext data key and a ciphertext data key cryptographically bound to the bucket name via `EncryptionContext`.

This establishes the client-side envelope encryption workflow and enforces the security boundary constraint.

Encrypt the file payload locally.

The file is encrypted using a local symmetric library (like AES-GCM) with the plaintext data key.

This keeps encryption client-side, handles payloads larger than the KMS 4 KB direct encryption limit, and reduces network latency.

Secure memory and prepare metadata.

The plaintext data key is purged from the application's memory, leaving only the ciphertext data key.

This minimizes the lifetime of the plaintext key in memory, satisfying the security requirements.

Upload the encrypted file and metadata.

The encrypted file is uploaded to the S3 bucket, with the ciphertext data key stored in S3 metadata.

This keeps the encrypted payload and its decryptable key together, allowing decryption later only if the exact bucket context is provided to the KMS Decrypt API.

Key Concept

AWS KMS Client-Side Envelope Encryption and EncryptionContext Bindings

Estimated Time:3m 0s

Question 12Question →

A developer needs to encrypt a large data file locally on an application server before uploading it to Amazon S3. The developer wants to use client-side envelope encryption with an AWS KMS customer managed key. Which of the following steps must the developer perform to complete this encryption process? (Select TWO.)

Select all that apply

Call the AWS KMS GenerateDataKey API operation to receive a plaintext data key and an encrypted ciphertext data key.

Encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.

Call the AWS KMS Encrypt API operation to encrypt the entire data file directly using the customer managed key.

Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation to obtain the plaintext data key for local encryption.

Save the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to use for decryption.

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API operation to receive a plaintext data key and an encrypted ciphertext data key.; Encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.

Answer

To encrypt the file using envelope encryption, the developer must call the GenerateDataKey API to obtain the plaintext and ciphertext data keys, encrypt the data locally with the plaintext key, and then delete the plaintext key from memory.

The correct options describe the client-side envelope encryption workflow: calling the GenerateDataKey API to get both the plaintext and ciphertext keys, using the plaintext key to encrypt the file locally, and subsequently discarding the plaintext key from memory.

Step-by-Step Solution

Generate data keys using AWS KMS

The application receives a plaintext data key and a ciphertext data key from the GenerateDataKey API call.

The plaintext key is needed to perform the encryption algorithm locally, and the ciphertext key is needed to store with the data for future decryption.

Encrypt the file locally

The file is encrypted using the plaintext data key.

Envelope encryption uses a unique symmetric data key locally to secure the file content.

Clean up memory and prepare storage

The plaintext key is deleted from the application's memory, and the encrypted file is paired with the ciphertext data key.

Removing the plaintext key from memory minimizes the risk of exposure. The ciphertext data key can be safely stored alongside the encrypted file in S3.

Key Concept

Envelope encryption is the practice of encrypting data with a data key, and then encrypting the data key under another key.

Estimated Time:1m 30s

Question 13Question →

A developer is implementing a security strategy for an application. The application needs to retrieve a database password and also encrypt application audit logs (average size $2\text{ MB}$ ) locally before archiving them to Amazon S3. The database password requires automatic rotation. The audit logs must be encrypted client-side using a customer managed key (KMS key) in AWS KMS. Which combination of services and KMS operations should the developer use to meet these requirements?

Store the database password in AWS Secrets Manager to enable automatic rotation. For the audit logs, call GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the logs locally with the plaintext key, and store the encrypted data key alongside the encrypted logs in S3.

Store the database password in Systems Manager Parameter Store to enable automatic rotation. For the audit logs, call Encrypt to encrypt the logs directly using the customer managed key before uploading them to S3.

Store the database password in AWS Secrets Manager. For the audit logs, call Decrypt to retrieve the plaintext customer managed key, encrypt the logs locally with the customer managed key, and upload them to S3.

Store the database password in AWS Secrets Manager. For the audit logs, call GenerateDataKeyWithoutPlaintext to obtain an encrypted data key, encrypt the logs locally using the encrypted data key, and upload them to S3.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager to enable automatic rotation. For the audit logs, call GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the logs locally with the plaintext key, and store the encrypted data key alongside the encrypted logs in S3.

Answer

The correct approach uses AWS Secrets Manager for the database password because it provides out-of-the-box automatic rotation. For the audit logs, since the payload size (

2\text{ MB}

) exceeds the

4\text{ KB}

limit of the KMS Encrypt API, the application must use envelope encryption. The GenerateDataKey API returns both the plaintext data key (used to encrypt the file locally) and the ciphertext data key (stored alongside the encrypted logs for future decryption).

Step-by-Step Solution

Select the appropriate secrets management service.

AWS Secrets Manager is selected because it natively supports database credential rotation, whereas Systems Manager Parameter Store does not.

Meeting the requirement for automatic rotation of the database password.

Determine the encryption method for the

2\text{ MB}

audit logs.

The Encrypt API has a

4\text{ KB}

limit, so client-side envelope encryption must be used.

Enabling the encryption of large files that exceed the KMS direct encryption payload limit.

Identify the correct KMS API call for envelope encryption.

GenerateDataKey is chosen because it returns the plaintext key needed for local encryption and the ciphertext key for storage.

Obtaining the necessary keys to encrypt the data locally and decrypt it later.

Key Concept

AWS KMS Envelope Encryption and Secrets Management

Estimated Time:1m 30s

Question 14Question →

A developer is implementing client-side encryption for an application that processes large database backups with an average size of $15$ GB before uploading them to an Amazon S3 bucket. To comply with corporate security policies, the developer must use AWS KMS and envelope encryption. Which sequence of operations should the developer implement to encrypt the backup files?

Retrieve a symmetric encryption key from AWS Secrets Manager using the GetSecretValue API, encrypt the database backup locally using this key, and upload the encrypted backup along with the secret version ID.

Call the GenerateDataKey API operation on AWS KMS to receive a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the database backup locally, erase the plaintext key from memory, and upload the encrypted backup along with the encrypted data key.

Call the Encrypt API operation on AWS KMS directly, passing the database backup as the plaintext parameter, and upload the resulting ciphertext to the Amazon S3 bucket.

Call the GenerateDataKeyWithoutPlaintext API operation on AWS KMS to obtain an encrypted data key, use the encrypted data key to encrypt the database backup locally, and upload the encrypted backup.

Show answer & explanation

Answer: Call the GenerateDataKey API operation on AWS KMS to receive a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the database backup locally, erase the plaintext key from memory, and upload the encrypted backup along with the encrypted data key.

Answer

The correct approach uses the GenerateDataKey API to obtain both a plaintext key (used for local encryption of the 15 GB file) and an encrypted data key (saved alongside the encrypted file). Discarding the plaintext key from memory after use adheres to the principle of least privilege and prevents memory scraping attacks.

Step-by-Step Solution

Request a data key from AWS KMS.

The application calls the GenerateDataKey API, receiving a plaintext data key and an encrypted data key.

This initiates the envelope encryption process by obtaining the required cryptographic keys.

Perform local encryption using the plaintext key.

The database backup is encrypted locally on the application server.

Because the database backup is 15 GB, it exceeds the 4 KB limit of the KMS Encrypt API and must be encrypted locally.

Clean up memory and upload artifacts.

The plaintext key is deleted from the application memory, and the encrypted backup file and the encrypted data key are uploaded to the S3 bucket.

Erasing the plaintext key from memory minimizes the risk of key exposure. The encrypted data key can be decrypted by KMS later when the backup needs to be restored.

Key Concept

AWS KMS Envelope Encryption

Estimated Time:2m 0s

Question 15Question →

A developer needs to encrypt a 5 GB file on an application server using AWS KMS client-side envelope encryption. Which AWS KMS API action should the developer call to obtain both the plaintext data key for local encryption and the encrypted copy of the data key for storage?

Encrypt

GenerateDataKey

GenerateDataKeyWithoutPlaintext

GetSecretValue

Show answer & explanation

Answer: GenerateDataKey

Answer

GenerateDataKey

The correct action is GenerateDataKey because it returns a plaintext data key for immediate local encryption and an encrypted version of the data key that can be safely stored alongside the encrypted file.

Step-by-Step Solution

Identify the size of the dataset and the encryption model.

The file size is 5 GB, which exceeds the 4 KB direct encryption limit of AWS KMS, requiring client-side envelope encryption.

Large files must be encrypted locally using a data key to avoid network overhead and KMS API payload size limits.

Determine the API call that provides the required keys for envelope encryption.

The developer needs a plaintext data key to perform the local encryption and an encrypted data key to save with the ciphertext.

Envelope encryption relies on having both the plaintext key to encrypt the payload and the encrypted key to bundle with the data for future decryption.

Select the correct KMS API action that returns both keys in a single request.

The GenerateDataKey API action returns both the plaintext data key and the encrypted ciphertext data key.

This single API call satisfies the security workflow without requiring subsequent decryption or extra round trips.

Key Concept

AWS KMS Envelope Encryption Workflow

Estimated Time:45s

Question 16Question →

A developer is implementing local client-side envelope encryption for sensitive reports in a microservice before uploading them to Amazon S3. To optimize costs and network overhead, the developer aims to generate a unique data key for each report using a customer managed key in AWS KMS. However, during integration testing, the developer observes that each file encryption requires two sequential AWS KMS API calls, which is causing latency and doubling API billing. The current implementation performs `kmsClient.generateDataKeyWithoutPlaintext(...)` followed by `kmsClient.decrypt(...)`. Which modification to the code should the developer make to reduce the integration to a single AWS KMS API call per report?

Replace the `generateDataKeyWithoutPlaintext` call with `encrypt` using the customer managed key to directly encrypt the report payload, and use the `decrypt` call to decrypt it upon retrieval.

Store a pre-generated plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter, retrieve it with a single call, and use the KMS `decrypt` API only to verify its integrity.

Replace the `generateDataKeyWithoutPlaintext` call with `generateDataKey` to obtain both the plaintext data key and the ciphertext data key in a single response, and remove the subsequent `decrypt` call.

Change the second call to `reEncrypt` to convert the ciphertext data key into a format readable by the local encryption utility, bypassing the need for a plaintext key.

Show answer & explanation

Answer: Replace the `generateDataKeyWithoutPlaintext` call with `generateDataKey` to obtain both the plaintext data key and the ciphertext data key in a single response, and remove the subsequent `decrypt` call.

Answer

The correct solution is to change the API call to `generateDataKey`. Under envelope encryption, the client requires the plaintext data key to encrypt the payload locally, and the ciphertext data key to store alongside the encrypted payload. The `generateDataKey` operation returns both in a single response, removing the need for a separate, subsequent call to the `decrypt` API to extract the plaintext key.

Step-by-Step Solution

Analyze the purpose of the current KMS API calls.

The application calls `generateDataKeyWithoutPlaintext` which only returns the encrypted (ciphertext) data key. Because it lacks the plaintext key to encrypt the payload, it must make a second call using the `decrypt` API.

Understanding the current behavior helps identify where the redundant call originates.

Select the appropriate KMS API operation for client-side envelope encryption.

Identify that the `generateDataKey` API operation returns both the plaintext data key and the ciphertext data key in a single payload.

This operation satisfies the requirements of envelope encryption by providing the plaintext key immediately for local encryption while providing the ciphertext key for storage.

Refactor the code to eliminate the secondary call.

Replace the initial call with `generateDataKey`, use the returned plaintext key to encrypt the file locally, discard the plaintext key from memory after use, and save the ciphertext key to Amazon S3 alongside the encrypted report.

This reduces the integration to a single KMS API request, minimizing latency and API costs by

50\%

Key Concept

AWS KMS Envelope Encryption Workflow Optimization

Question 17Question →

An application needs to encrypt large files locally before uploading them to Amazon S3. The developer decides to use client-side envelope encryption with an AWS Key Management Service (AWS KMS) customer managed key. The developer calls the GenerateDataKey API operation.

Which two components are returned by this API call to enable envelope encryption? (Select TWO.)

Select all that apply

A plaintext data key, which the application uses to encrypt the data.

The raw data encrypted directly by AWS KMS, which the application uploads to S3.

An encrypted copy of the data key (ciphertext), which is stored with the encrypted data.

The private key of the customer managed key, which is used to decrypt the data key locally.

A secure parameter path in Systems Manager Parameter Store where the data key is automatically saved.

Show answer & explanation

Answer: A plaintext data key, which the application uses to encrypt the data.; An encrypted copy of the data key (ciphertext), which is stored with the encrypted data.

Answer

The API returns a plaintext data key for immediate encryption and an encrypted data key (ciphertext) to be stored alongside the encrypted data.

In client-side envelope encryption, the GenerateDataKey API operation returns a plaintext data key and an encrypted data key. The plaintext data key is used by the application to encrypt the files locally. The encrypted data key is stored alongside the encrypted files so that it can be sent back to KMS for decryption in the future.

Step-by-Step Solution

Analyze the request for client-side envelope encryption using the GenerateDataKey API.

The application needs to encrypt data locally, which requires a local key.

Understanding the core flow of envelope encryption where encryption happens on the client side using a locally generated symmetric key.

Determine the output of the GenerateDataKey API operation.

AWS KMS returns both the plaintext data key and the encrypted data key.

The plaintext key is required for immediate local encryption, and the encrypted key is required for future decryption when requesting KMS to decrypt it.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 18Question →

A microservice running on AWS Lambda needs to perform local client-side envelope encryption on application log files that range from $10$ MB to $50$ MB in size before storing them in an on-premises archive. The microservice must use a customer managed key in AWS KMS.

Which of the following configuration and SDK coding steps should the developer perform to implement this securely with minimum privilege? (Select TWO.)

Select all that apply

Call the `GenerateDataKey` API operation in the application code, using the plaintext data key to encrypt the log file locally, and discard the plaintext key from memory immediately after encryption.

Add `kms:GenerateDataKey` permissions to the Lambda function's IAM execution role for the specific ARN of the customer managed key.

Call the `Encrypt` API operation in the application code, passing the raw log file as the plaintext parameter to be encrypted directly by KMS.

Call the `GenerateDataKeyWithoutPlaintext` API operation in the application code to retrieve the ciphertext data key, then use the Lambda function's default environment variables to decrypt it.

Grant `kms:Decrypt` and `kms:GenerateDataKey` permissions on the AWS managed key `aws/s3` to the Lambda execution role.

Show answer & explanation

Answer: Call the `GenerateDataKey` API operation in the application code, using the plaintext data key to encrypt the log file locally, and discard the plaintext key from memory immediately after encryption.; Add `kms:GenerateDataKey` permissions to the Lambda function's IAM execution role for the specific ARN of the customer managed key.

Answer

To implement local client-side envelope encryption for large files with minimum privilege, the developer must call `GenerateDataKey` in the application code to obtain the plaintext and ciphertext data keys, and grant `kms:GenerateDataKey` permissions on the customer managed key to the Lambda execution role.

For files larger than

4

KB, local client-side envelope encryption must be utilized. Calling the `GenerateDataKey` API operation provides the plaintext key required to encrypt the logs locally and the ciphertext key to store along with the encrypted logs. The Lambda execution role must be granted permissions to execute `kms:GenerateDataKey` on the specific customer managed key's ARN to adhere to the principle of least privilege.

Step-by-Step Solution

Analyze the size of the data to be encrypted (

10

MB to

50

MB) to determine the encryption method.

Direct encryption via the KMS `Encrypt` API is ruled out due to its

4096

bytes limit, indicating that local client-side envelope encryption is required.

Understanding KMS payload limits is necessary to select the correct encryption workflow.

Determine the correct KMS API operation to generate encryption keys.

The application must call `GenerateDataKey` to retrieve both the plaintext data key (for local encryption) and the ciphertext data key (for storage).

Calling `GenerateDataKeyWithoutPlaintext` would not yield the plaintext key needed to perform the encryption.

Configure the Lambda execution role's IAM policy for least privilege access to the KMS key.

Allow the `kms:GenerateDataKey` action on the specific ARN of the customer managed key.

Granting permissions on AWS managed keys like `aws/s3` is incorrect because the key policies cannot be modified and the resource constraint must point to the customer managed key.

Key Concept

AWS KMS Envelope Encryption Workflow and IAM Permissions

Estimated Time:2m 0s

Question 19Question →

A developer needs to secure a database connection string containing credentials. The string is $2\text{ KB}$ in size, and the developer wants to perform direct server-side encryption using an AWS KMS customer managed key without generating and managing local data keys. Which AWS KMS API operation should the developer call to encrypt this payload directly?

GenerateDataKey

GenerateDataKeyWithoutPlaintext

Encrypt

PutParameter

Show answer & explanation

Answer: Encrypt

Answer

The correct answer is the Encrypt API operation, which allows direct encryption of small payloads up to

4\text{ KB}

The Encrypt API operation in AWS KMS is designed to directly encrypt small payloads up to

4\text{ KB}

using a specified KMS key. Since the database connection string is only

2\text{ KB}

in size, the developer can send the plaintext directly to AWS KMS for encryption without the overhead of generating, managing, and storing local data keys.

Step-by-Step Solution

Analyze the payload size and the requirement to avoid local data key management.

The database connection string is

2\text{ KB}

in size, and direct encryption is preferred over envelope encryption.

This determines if direct encryption is possible and matches the developer's preference.

Check the maximum payload limit for the AWS KMS Encrypt API.

The Encrypt API supports direct encryption of data payloads up to

4\text{ KB}

To verify that the

2\text{ KB}

payload is within the direct encryption threshold.

Identify the KMS API operation that performs direct encryption on the payload.

The Encrypt operation takes the plaintext payload and returns the ciphertext directly.

To select the operation that meets all requirements without introducing envelope encryption complexity.

Key Concept

AWS KMS Direct Encryption Limits

Estimated Time:45s

Question 20Question →

A developer is implementing client-side decryption for a microservice that retrieves encrypted configuration files (each under $10$ KB in size) from an external datastore. The files were encrypted using envelope encryption with an AWS KMS customer managed key. The datastore contains the ciphertext payload and the encrypted data key (ciphertext data key). Which two steps must the developer's application perform to decrypt the payload?

Select all that apply

Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to retrieve the plaintext data key.

Decrypt the ciphertext payload locally using the retrieved plaintext data key and the appropriate decryption algorithm.

Call the Decrypt API operation of AWS KMS, passing the ciphertext payload directly to retrieve the decrypted plaintext payload.

Retrieve the plaintext data key from AWS Systems Manager Parameter Store by querying a SecureString parameter.

Call the GenerateDataKey API operation of AWS KMS, passing the ciphertext data key to recover the plaintext data key.

Show answer & explanation

Answer: Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to retrieve the plaintext data key.; Decrypt the ciphertext payload locally using the retrieved plaintext data key and the appropriate decryption algorithm.

Answer

To decrypt the payload, the application must call the KMS Decrypt API operation with the ciphertext data key to get the plaintext data key, and then decrypt the ciphertext payload locally using that plaintext data key.

To decrypt a payload that was encrypted using envelope encryption, the client application first extracts the encrypted data key (ciphertext data key) that is stored alongside the payload. The application then sends this ciphertext data key to AWS KMS by calling the Decrypt API operation. AWS KMS decrypts the data key using the specified customer managed key and returns the plaintext data key to the application. Finally, the application uses this plaintext data key to decrypt the ciphertext payload locally. This ensures that the heavy decryption workload is done client-side and the sensitive raw payload is never sent over the network to AWS KMS.

Step-by-Step Solution

Isolate the ciphertext data key.

The ciphertext data key is separated from the encrypted configuration payload.

AWS KMS envelope encryption requires decrypting the data key before the data itself can be decrypted.

Decrypt the data key via AWS KMS.

AWS KMS decrypts the ciphertext data key and returns the plaintext data key.

The client application does not have access to the backing customer managed key and must delegate decryption of the data key to AWS KMS.

Decrypt the payload locally.

The configuration payload is decrypted back to plaintext.

Performing decryption locally avoids the network overhead of sending the payload to AWS KMS and bypasses the payload size limits of the KMS Decrypt API.

Key Concept

AWS KMS Envelope Encryption Decryption Workflow

Page 1 / 5Next

AWS KMS and Encryption

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept