Examkin

Soru

Zorluk: OrtaAWS KMS and Encryption

A developer is building a document archiving application where PDF files of approximately 5 MB5\text{ MB} each must be encrypted on the client side before they are uploaded to an Amazon S3 bucket. The encryption must be performed using an AWS KMS customer managed key. Which two steps must the developer perform to implement this encryption process? (Select two.)

  1. Call the GenerateDataKey API operation using the customer managed key identifier to receive a plaintext data key and an encrypted data key.Cevap
  2. Encrypt the PDF file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted PDF along with the encrypted data key to Amazon S3.Cevap
  3. C
    Call the Encrypt API operation directly, passing the entire 5 MB5\text{ MB} PDF file as the plaintext payload to be encrypted by the customer managed key.
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation to obtain the encrypted data key, and use the encrypted data key directly to perform symmetric encryption on the PDF file.
  5. E
    Call the GetPublicKey API operation to download the private key material of the customer managed key to perform local symmetric encryption.

Cevap

The developer must call the GenerateDataKey API operation to retrieve both the plaintext and encrypted data keys, encrypt the PDF locally with the plaintext data key, delete the plaintext data key from memory, and then upload the encrypted PDF and the encrypted data key to Amazon S3.
For files larger than 4 KB4\text{ KB}, direct encryption via AWS KMS is not possible due to size limitations. Instead, client-side envelope encryption must be used. Under this model, the developer calls the GenerateDataKey API operation to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the 5 MB5\text{ MB} file locally, after which the plaintext key is deleted from memory to maintain security. Finally, the encrypted PDF and the encrypted data key are uploaded together to Amazon S3 so that the file can be decrypted in the future using the Decrypt API on the encrypted data key.

Adım Adım Çözüm

1
Request a data key from KMS by calling GenerateDataKey.
The application receives a plaintext data key and an encrypted data key.
Because files larger than 4 KB4\text{ KB} cannot be directly encrypted using the KMS Encrypt API, client-side envelope encryption is required.
2
Encrypt the 5 MB5\text{ MB} PDF locally using a symmetric encryption algorithm (such as AES-256) with the plaintext data key.
The PDF file is converted into ciphertext.
The plaintext data key is needed by the local encryption library to encrypt the raw file payload.
3
Erase the plaintext data key from memory, and upload the ciphertext PDF and the encrypted data key to Amazon S3.
The encrypted file and its metadata (the encrypted data key) are securely stored in S3, and no plaintext key remains in the application's memory.
Removing the plaintext data key minimizes the window of exposure, and storing the encrypted data key with the ciphertext is necessary for later decryption.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru