Examkin

Soru

Zorluk: OrtaAWS KMS and Encryption

A developer is designing a microservice that processes sensitive transaction payloads of approximately 1.5 MB1.5\text{ MB} each. The microservice must encrypt these payloads before storing them in an on-premises database. The encryption keys must be managed in AWS KMS. Which approach should the developer use to perform the encryption in a secure and efficient manner?

  1. A
    Call the Encrypt API operation directly, passing the payload and the customer managed key identifier, then store the resulting ciphertext in the database.
  2. B
    Store the transaction payloads directly in AWS Systems Manager Parameter Store as SecureString parameters, configuring Parameter Store to use the KMS customer managed key for encryption.
  3. Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.Cevap
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation to obtain an encrypted data key. Decrypt the key locally using a client-side cryptographic library, use it to encrypt the payload, and discard the key.

Cevap

Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.
For data larger than 4 KB4\text{ KB}, developers must use envelope encryption. Calling the GenerateDataKey API provides a plaintext data key to perform local symmetric encryption of the 1.5 MB1.5\text{ MB} payload and an encrypted copy of the data key. Once encryption is complete, the plaintext data key is discarded from memory, and the encrypted payload is stored alongside the encrypted data key. The encrypted data key can later be sent to KMS Decrypt to retrieve the plaintext key for decryption.

Adım Adım Çözüm

1
Identify the size limit of the direct KMS Encrypt API and compare it to the transaction payload size.
The transaction payload is 1.5 MB1.5\text{ MB}, which exceeds the 4 KB4\text{ KB} limit of the direct KMS Encrypt API.
KMS direct encryption cannot process payloads larger than 4 KB4\text{ KB}, requiring the use of envelope encryption.
2
Evaluate the options for envelope encryption using AWS KMS APIs.
Calling GenerateDataKey provides both the plaintext data key for local encryption and the encrypted data key for storage.
GenerateDataKey generates the keys locally without transmitting the actual data payload to KMS, which is highly efficient.
3
Complete the envelope encryption workflow locally on the client.
The plaintext key encrypts the payload, is removed from memory, and the encrypted payload is stored with the encrypted data key.
This ensures the plaintext key is not exposed and the data can be decrypted later by decrypting the data key with KMS.

Anahtar Kavram

KMS Envelope Encryption and API Limits
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru