An e-commerce backend running on AWS Lambda needs to store sensitive customer profile data in an Amazon RDS database. Due to compliance requirements, the application must encrypt the profile data client-side before sending it to the database. The size of each profile is approximately .
Which of the following steps must the developer perform in the application code to implement this client-side encryption? (Select TWO)
- Call the KMS GenerateDataKey API using a customer managed key to obtain a plaintext data key and an encrypted data key.Cevap
- Encrypt the customer profile data locally using the plaintext data key, and then delete the plaintext data key from memory.Cevap
- CSend the profile data directly to the KMS Encrypt API using a customer managed key.
- DCall the KMS GenerateDataKeyWithoutPlaintext API to obtain the plaintext data key and use it to encrypt the profile data locally.
- EDownload the private key material of the customer managed key from AWS Systems Manager Parameter Store to encrypt the profile data locally.
Cevap
Call the KMS GenerateDataKey API using a customer managed key to obtain a plaintext data key and an encrypted data key, and encrypt the customer profile data locally using the plaintext data key, and then delete the plaintext data key from memory.
For payloads larger than 4 KB, such as a 350 KB customer profile, developers must use envelope encryption. This involves calling the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the data locally in the application, and is then immediately deleted from memory for security. The encrypted data key is stored alongside the encrypted data.
Adım Adım Çözüm
Anahtar Kavram
AWS KMS Envelope Encryption
Tahmini Süre:1m 30s