An application needs to encrypt large files locally before uploading them to Amazon S3. The developer decides to use client-side envelope encryption with an AWS Key Management Service (AWS KMS) customer managed key. The developer calls the GenerateDataKey API operation.
Which two components are returned by this API call to enable envelope encryption? (Select TWO.)
- A plaintext data key, which the application uses to encrypt the data.Cevap
- BThe raw data encrypted directly by AWS KMS, which the application uploads to S3.
- An encrypted copy of the data key (ciphertext), which is stored with the encrypted data.Cevap
- DThe private key of the customer managed key, which is used to decrypt the data key locally.
- EA secure parameter path in Systems Manager Parameter Store where the data key is automatically saved.
Cevap
The API returns a plaintext data key for immediate encryption and an encrypted data key (ciphertext) to be stored alongside the encrypted data.
In client-side envelope encryption, the GenerateDataKey API operation returns a plaintext data key and an encrypted data key. The plaintext data key is used by the application to encrypt the files locally. The encrypted data key is stored alongside the encrypted files so that it can be sent back to KMS for decryption in the future.
Adım Adım Çözüm
Anahtar Kavram
AWS KMS Envelope Encryption Workflow