Examkin

Soru

Zorluk: OrtaAWS KMS and Encryption

A developer is writing an application that must encrypt a 250 KB250\text{ KB} application configuration file client-side before uploading it to an Amazon S3 bucket. The security policy requires using envelope encryption with an AWS KMS Customer Managed Key (CMK).

Which of the following workflows should the developer implement to meet these requirements?

  1. Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, destroy the plaintext key from memory, and upload the encrypted file along with the encrypted data key to Amazon S3.Cevap
  2. B
    Call the KMS Encrypt API directly, passing the configuration file's plaintext bytes and the CMK ID to receive the ciphertext, and then upload the ciphertext to Amazon S3.
  3. C
    Call the KMS GenerateDataKeyWithoutPlaintext API to receive an encrypted data key. Call the KMS Decrypt API with the encrypted data key to retrieve the plaintext data key, encrypt the file locally, and upload both the encrypted file and the encrypted data key to Amazon S3.
  4. D
    Store the configuration file content in AWS Systems Manager Parameter Store as a SecureString parameter referencing the CMK, and configure the application to retrieve it directly using the Parameter Store API.

Cevap

Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, destroy the plaintext key from memory, and upload the encrypted file along with the encrypted data key to Amazon S3.
The correct workflow is to call the KMS GenerateDataKey API to retrieve both the plaintext and encrypted data keys. The plaintext key is used to encrypt the 250 KB250\text{ KB} file client-side, after which it is deleted from memory. The encrypted data key is stored alongside the encrypted file in Amazon S3 for future decryption.

Adım Adım Çözüm

1
Generate a unique data key using the Customer Managed Key (CMK) via the AWS KMS GenerateDataKey API.
AWS KMS returns a plaintext data key and a ciphertext data key encrypted by the CMK.
This establishes the cryptographic key material needed for client-side envelope encryption without passing the large file payload over the network to KMS.
2
Encrypt the 250 KB250\text{ KB} configuration file locally using the plaintext data key and a symmetric algorithm (e.g., AES-256), then securely delete the plaintext data key from memory.
The file is encrypted into ciphertext, and the plaintext data key is no longer in local memory.
Encrypting locally handles the large file size which exceeds the KMS direct encryption limit of 4 KB4\text{ KB}, and clearing the plaintext key reduces memory exposure risk.
3
Upload the encrypted configuration file and the ciphertext data key to the Amazon S3 bucket.
Both the encrypted file and the encrypted data key are stored in S3.
Storing the encrypted data key alongside the encrypted file ensures the application can later retrieve the encrypted key and request KMS to decrypt it when reading the file.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru