Examkin

Soru

Zorluk: ZorAWS KMS and Encryption

A company requires a developer to implement client-side encryption for sensitive application log files before uploading them to an Amazon S3 bucket. The log files range in size from 5 MB5\text{ MB} to 50 MB50\text{ MB}. The developer wants to minimize network overhead and ensure compliance by utilizing a customer managed key in AWS Key Management Service (AWS KMS) for envelope encryption. Which workflow should the developer implement to encrypt the log files?

  1. Call the GenerateDataKey API using the customer managed key to receive a plaintext data key and an encrypted data key. Encrypt the log file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted log file and the encrypted data key to the S3 bucket.Cevap
  2. B
    Call the Encrypt API using the customer managed key, passing the raw log file payload in the request. Store the returned ciphertext file in the S3 bucket.
  3. C
    Call the GenerateDataKey API using the customer managed key to obtain a plaintext data key. Encrypt the log file locally using this key, and then store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to allow the decryption service to retrieve it.
  4. D
    Call the GenerateDataKey API by initializing an AWS SDK client that hardcodes the access keys of an IAM user who has permissions to use the customer managed key, encrypt the log file locally with the returned plaintext key, and upload the encrypted log file to S3.

Cevap

Call the GenerateDataKey API using the customer managed key to receive a plaintext data key and an encrypted data key. Encrypt the log file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted log file and the encrypted data key to the S3 bucket.
The correct workflow is to use envelope encryption. The developer calls the GenerateDataKey API, which utilizes the customer managed key to output a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the payload locally, after which it is deleted from memory. The encrypted data key is stored alongside the encrypted payload. This allows encryption of large objects without hitting the 4 KB4\text{ KB} limit of KMS direct encryption operations and minimizes network overhead because the large payload is not sent to KMS.

Adım Adım Çözüm

1
Invoke the GenerateDataKey API operation using the AWS SDK.
AWS KMS returns a plaintext data key and an encrypted data key (ciphertext).
This avoids sending the large payload to AWS KMS, overcoming the 4 KB4\text{ KB} limitation of direct encryption API operations.
2
Encrypt the log file locally using the plaintext data key.
The log file is converted into ciphertext using a local symmetric encryption algorithm (such as AES-256).
Doing this locally minimizes network overhead and ensures the plaintext data never leaves the client environment.
3
Clean up memory and upload the artifacts to Amazon S3.
The plaintext data key is purged from memory. The encrypted log file and the encrypted data key are uploaded together to Amazon S3.
Removing the plaintext data key prevents unauthorized memory inspection, and keeping the encrypted data key with the file enables decryption later.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow and Limits
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru