A developer is building a containerized application running on Amazon ECS. The application must encrypt application log archives of approximately each on the client side before uploading them to an Amazon S3 bucket. The developer wants to use a customer managed key in AWS KMS.
Which of the following steps are required to implement this client-side envelope encryption workflow? (Select TWO.)
- Call the GenerateDataKey API operation to receive both a plaintext data key and an encrypted copy of the data key.Cevap
- Encrypt the log archive locally using the plaintext data key, then immediately remove the plaintext data key from the application's memory.Cevap
- CCall the Encrypt API operation directly, passing the entire log archive as the plaintext parameter.
- DCall the GenerateDataKeyWithoutPlaintext API operation, and use the customer managed key's public key to encrypt the log archive.
- EStore the plaintext data key in AWS Systems Manager Parameter Store with secure string parameters for future decryption processes.
Cevap
To perform client-side envelope encryption for files larger than , the developer must call the GenerateDataKey API operation to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the files locally and must be destroyed from memory immediately after use. The encrypted data key is stored alongside the encrypted files for future decryption.
The correct steps to implement client-side envelope encryption are to call the GenerateDataKey API operation to retrieve both the plaintext and encrypted data keys, encrypt the data locally with the plaintext key, and then delete the plaintext key from memory. This complies with security best practices and allows the encryption of files larger than the KMS direct encryption limit.
Adım Adım Çözüm
Anahtar Kavram
AWS KMS Envelope Encryption Workflow