Examkin

Soru

Zorluk: OrtaAWS KMS and Encryption

A developer is building an application that must encrypt raw sensor data files, each approximately 20 MB20\text{ MB} in size, locally on an application server before uploading them to a third-party storage system. The developer wants to use envelope encryption with a customer managed AWS KMS key. Which two steps must the developer perform to implement this encryption process?

  1. Call the GenerateDataKey API operation using the customer managed KMS key to obtain a plaintext data key and an encrypted copy of the data key.Cevap
  2. Encrypt the sensor data locally using the plaintext data key, and then delete the plaintext data key from memory.Cevap
  3. C
    Call the KMS Encrypt API operation directly to encrypt each sensor data file.
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation, and decrypt the returned ciphertext using the public certificate of the KMS key.
  5. E
    Store the plaintext data key as a SecureString parameter in AWS Systems Manager Parameter Store to use for subsequent decryption operations.

Cevap

To implement envelope encryption for files larger than 4 KB4\text{ KB}, the developer must call the GenerateDataKey API to obtain both a plaintext and an encrypted data key, encrypt the data locally using the plaintext data key, and then immediately destroy the plaintext key from memory.
The correct steps for envelope encryption involve calling the GenerateDataKey API operation to retrieve a plaintext data key and an encrypted version of that key. The application then uses the plaintext data key to perform local symmetric encryption of the payload, and finally deletes the plaintext key from memory. The encrypted data key is saved alongside the encrypted data so that it can be decrypted by KMS later.

Adım Adım Çözüm

1
Invoke the KMS GenerateDataKey API.
The API returns a plaintext version of the data key and a ciphertext version encrypted under the customer managed KMS key.
Because the files are 20 MB20\text{ MB} in size, they exceed the direct KMS encryption limit of 4 KB4\text{ KB}, requiring local envelope encryption.
2
Encrypt the raw sensor data locally using a symmetric encryption algorithm and the plaintext data key.
The file is encrypted to a ciphertext payload.
Performing encryption locally offloads the cryptographic workload from KMS to the application server.
3
Discard the plaintext data key from application memory, and store the encrypted data key alongside the encrypted payload.
Only the encrypted data key and the encrypted payload remain.
Retaining the plaintext key in memory increases security risks. The encrypted data key is safe to store next to the encrypted file and will be used during decryption.

Anahtar Kavram

Envelope encryption is the practice of encrypting plaintext data with a data key, and then encrypting the data key under another key (the KMS root key). It is required for encrypting data payloads larger than 4 KB4\text{ KB} using AWS KMS.
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru