Examkin

Soru

Zorluk: Çok zorAWS KMS and Encryption

A developer is designing a serverless backend using AWS Lambda that processes sensitive customer records. Each record contains a profile payload averaging 1515 KB in size. The application must encrypt these payloads before storing them in an Amazon DynamoDB table. To meet strict performance and cost-efficiency requirements, the developer must implement client-side envelope encryption using a Customer Managed Key (CMK) managed by AWS KMS. Which of the following application workflows represents the most secure, cost-effective, and architecturally correct implementation of client-side envelope encryption?

  1. A
    Call the KMS Encrypt API directly, passing the 1515 KB customer record as the plaintext payload. Store the returned ciphertext blob directly in the DynamoDB table.
  2. B
    Generate a symmetric key locally in the Lambda function, encrypt the customer record with it, and call the KMS Encrypt API to encrypt the local key. Store the encrypted record in DynamoDB, and store the encrypted symmetric key in AWS Secrets Manager using a unique secret per customer record.
  3. C
    Call the KMS GenerateDataKeyWithoutPlaintext API to retrieve an encrypted data key. Store this key in Systems Manager Parameter Store, and then call the KMS Decrypt API within the Lambda function to get the plaintext key to encrypt the payload.
  4. Call the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. Encrypt the customer record payload locally using the plaintext data key, delete the plaintext data key from memory, and store the encrypted payload and the encrypted data key together in the DynamoDB item.Cevap

Cevap

The correct workflow calls the KMS GenerateDataKey API to obtain both the plaintext data key and the encrypted data key in a single request. The plaintext key is used locally to encrypt the payload and then immediately cleared from memory, while the encrypted data key is stored directly alongside the encrypted payload in the DynamoDB table.
The correct workflow uses the GenerateDataKey API, which yields both a plaintext data key and an encrypted data key in a single request. The plaintext key is used locally to encrypt the payload and then immediately cleared from memory, while the encrypted data key is stored directly alongside the encrypted payload in the DynamoDB table. This implements client-side envelope encryption securely and efficiently, bypassing the 44 KB size limit of the Encrypt API without introducing unnecessary API calls or storage overhead.

Adım Adım Çözüm

1
Evaluate the payload size and KMS constraints.
The record size of 1515 KB exceeds the 44 KB direct encryption limit of the KMS Encrypt API, indicating envelope encryption is required.
To determine if direct KMS encryption is a viable or correct option.
2
Analyze key generation and retrieval efficiency.
Using GenerateDataKey provides both the plaintext key (for immediate encryption) and the ciphertext key in a single API call, whereas GenerateDataKeyWithoutPlaintext would require a second Decrypt API call.
To minimize KMS API costs and latency.
3
Determine the storage location for the encrypted data key.
The encrypted data key should be stored directly alongside the encrypted payload in the DynamoDB item, rather than external systems like Secrets Manager or Parameter Store.
To avoid external resource overhead, scale efficiently, and follow proper envelope encryption architecture.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru