Examkin

Soru

Zorluk: KolayAWS KMS and Encryption

A developer is writing a Python application to secure sensitive application configuration files locally before uploading them to Amazon S3. The compliance policy requires the developer to use client-side envelope encryption with an AWS Key Management Service (AWS KMS) customer managed key. Which two actions must the developer perform to implement this encryption workflow? (Select TWO.)

  1. Call the KMS GenerateDataKey API, passing the KMS key ID, to retrieve both a plaintext data key and an encrypted data key.Cevap
  2. Use the plaintext data key to encrypt the files locally using a symmetric encryption algorithm.Cevap
  3. C
    Call the KMS GenerateDataKeyWithoutPlaintext API to obtain an encrypted data key, and use the encrypted data key to encrypt the files locally.
  4. D
    Call the KMS Encrypt API directly for each configuration file, passing the raw file contents to be encrypted by AWS KMS.
  5. E
    Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to be accessed later during decryption.

Cevap

The developer must call the KMS GenerateDataKey API to obtain the plaintext and encrypted data keys, and use the plaintext data key to encrypt the files locally.
In client-side envelope encryption, the application calls the GenerateDataKey API to obtain both a plaintext data key and an encrypted version of that key. The application uses the plaintext key to encrypt the files locally, and then discards the plaintext key from memory. The encrypted data key is stored alongside the encrypted data.

Adım Adım Çözüm

1
Request a data key from AWS KMS.
The application receives a plaintext data key and an encrypted data key (ciphertext key) from the GenerateDataKey API call.
The plaintext key is required for local encryption, and the encrypted key is required for future decryption.
2
Encrypt the files locally.
The configuration files are encrypted using a symmetric encryption library (e.g., cryptography in Python) with the plaintext data key.
Envelope encryption requires the actual data to be encrypted client-side using the local plaintext data key.
3
Discard the plaintext key and store the encrypted key.
The plaintext data key is deleted from memory, and the encrypted data key is uploaded to Amazon S3 alongside the encrypted files.
Deleting the plaintext key ensures security, while storing the encrypted key allows authorization checks and decryption when retrieved.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru