Examkin

Soru

Zorluk: ZorAWS KMS and Encryption

A developer is building a high-security microservice that processes sensitive transaction payloads. The application uses client-side envelope encryption with an AWS KMS customer managed key. The developer must ensure that:

1. The encrypted transaction payloads are cryptographically bound to a specific TransactionIDTransactionID and VaultRegionVaultRegion to prevent decryption under any other context.
2. All cryptographic operations are logged in AWS CloudTrail with these context details for compliance auditing.

Which two actions must the developer take to implement this encryption workflow?

  1. Call the GenerateDataKey API with the EncryptionContext parameter containing the TransactionID and VaultRegion as key-value pairs.Cevap
  2. Pass the identical EncryptionContext key-value pairs in the Decrypt API call when decrypting the encrypted data key.Cevap
  3. C
    Call the GenerateDataKey API without a context, and pass the TransactionID and VaultRegion only in the Decrypt API call to filter the decryption logs.
  4. D
    Save the TransactionID and VaultRegion as secure string parameters in AWS Systems Manager Parameter Store to automatically manage the decryption context.
  5. E
    Call the Encrypt API directly for the transaction payload and pass the EncryptionContext in the GrantTokens parameter to bypass policy checks.

Cevap

To implement this client-side envelope encryption workflow, the developer must call the GenerateDataKey API with the EncryptionContext parameter containing the TransactionID and VaultRegion as key-value pairs, and pass the identical EncryptionContext key-value pairs in the Decrypt API call when decrypting the encrypted data key.
The correct options describe the standard AWS KMS envelope encryption workflow using Encryption Context. The EncryptionContext parameter in the GenerateDataKey API call cryptographically binds the key-value pair metadata (TransactionID and VaultRegion) to the encrypted data key. During decryption, passing the identical EncryptionContext map is mandatory; otherwise, AWS KMS cannot decrypt the data key. Both calls are logged in AWS CloudTrail with the encryption context in plaintext.

Adım Adım Çözüm

1
Generate a unique data key with context.
The application calls the GenerateDataKey API on AWS KMS, passing the Customer Managed Key ARN and an EncryptionContext map containing the TransactionID and VaultRegion.
This cryptographically binds the metadata to the encrypted version of the data key and records it in AWS CloudTrail.
2
Encrypt the payload locally.
The application uses the plaintext data key to encrypt the transaction payload locally, then discards the plaintext data key from memory.
This completes the client-side envelope encryption process safely without exposing the plaintext key.
3
Decrypt the data key using the identical context.
When decrypting the payload, the application calls the Decrypt API, passing the ciphertext data key and the identical EncryptionContext map.
AWS KMS validates the context against the cryptographic signature in the ciphertext. If they match, it returns the plaintext data key to decrypt the payload.

Anahtar Kavram

AWS KMS Encryption Context in Envelope Encryption
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru