An application running on AWS Fargate generates monthly audit reports (each approximately in size) that must be encrypted client-side before they are stored in an external third-party storage system. The developer wants to use AWS Key Management Service (AWS KMS) with a customer managed key to secure these reports.
Which of the following actions must the developer take to implement this client-side encryption workflow? (Select TWO.)
- Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.Cevap
- BCall the Encrypt API of AWS KMS to encrypt the audit report directly.
- CCall the GenerateDataKeyWithoutPlaintext API of AWS KMS to obtain an encrypted data key, and use it to encrypt the audit report locally.
- Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.Cevap
- EStore the plaintext data key in AWS Systems Manager Parameter Store as a SecureString to reuse it for subsequent audit reports.
Cevap
To encrypt a file larger than client-side, the developer must generate a data key by calling the GenerateDataKey API, use the returned plaintext data key to encrypt the report locally, discard the plaintext key from memory, and store the encrypted data key alongside the encrypted audit report.
To encrypt a large file client-side using AWS KMS, the developer must implement envelope encryption. This involves calling the GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the audit report locally, after which the plaintext key is discarded from memory. The encrypted data key is then stored with the encrypted report so that it can be decrypted later by calling the Decrypt API to recover the plaintext key.
Adım Adım Çözüm
Anahtar Kavram
AWS KMS client-side envelope encryption workflow for objects exceeding the direct encryption size limits.