A developer needs to encrypt database backup files, each approximately in size, before uploading them to an Amazon S3 bucket. The security policy requires client-side encryption using a customer managed key in AWS KMS. Which of the following actions must the developer perform to implement client-side envelope encryption for these files? (Select TWO.)
- Call the GenerateDataKey API operation, passing the KMS key identifier, to obtain a plaintext data key and an encrypted data key.Cevap
- Encrypt the file locally using the plaintext data key, upload the encrypted file and the encrypted data key to Amazon S3, and then delete the plaintext data key from memory.Cevap
- CCall the Encrypt API operation directly, passing the KMS key identifier and the entire file payload.
- DCall the GenerateDataKeyWithoutPlaintext API operation to obtain the data key for local encryption of the backup files.
- EConfigure AWS Systems Manager Parameter Store to automatically rotate the database credentials and generate a database backup key.
Cevap
Call the GenerateDataKey API operation to obtain both a plaintext data key and an encrypted data key, encrypt the file locally using the plaintext key, and then delete the plaintext key from memory.
The correct options outline the standard KMS envelope encryption workflow. A developer calls the GenerateDataKey API operation to get both the plaintext key and the encrypted key. The plaintext key is used to encrypt the large payload locally, and then it is immediately deleted from memory. The encrypted data key is stored with the encrypted data for future decryption.
Adım Adım Çözüm
Anahtar Kavram
Envelope encryption involves generating a unique data key to encrypt large data payloads locally, then storing the encrypted data key alongside the encrypted data while discarding the plaintext key from memory.