Examkin

Soru

Zorluk: OrtaAWS KMS and Encryption

A developer is designing a containerized microservice that runs on Amazon ECS. The microservice must store sensitive customer data in an Amazon DynamoDB table. Due to compliance requirements, the data must be encrypted client-side before it is sent to DynamoDB. The developer wants to use envelope encryption with an AWS KMS customer managed key to minimize KMS API calls and encrypt the data efficiently. Which two API operations must the developer implement in the microservice code to manage the keys for this client-side encryption and decryption workflow? (Select TWO.)

  1. kms:GenerateDataKeyCevap
  2. kms:DecryptCevap
  3. C
    kms:GenerateDataKeyWithoutPlaintext
  4. D
    kms:Encrypt
  5. E
    ssm:GetParameter

Cevap

The correct answer consists of the operations kms:GenerateDataKey and kms:Decrypt.
The correct operations are kms:GenerateDataKey and kms:Decrypt. In envelope encryption, the application calls kms:GenerateDataKey to obtain a plaintext data key (to encrypt the payload locally) and a ciphertext data key (to store alongside the encrypted payload). To decrypt the data, the application calls kms:Decrypt with the ciphertext data key to retrieve the plaintext data key, which is then used to decrypt the payload locally.

Adım Adım Çözüm

1
Analyze the requirement for client-side envelope encryption and decryption of DynamoDB items using a customer managed key.
Identify that the application needs to dynamically generate a unique symmetric data key for each item, encrypt the payload locally, store the encrypted key with the item, and retrieve the plaintext key for decryption later.
This establishes the workflow where the KMS customer managed key is only used to protect the data keys, not the database payloads directly.
2
Determine the API operation required for the encryption phase.
Identify kms:GenerateDataKey as the API call that provides the plaintext key for immediate local encryption and the ciphertext key for storage.
Using kms:GenerateDataKeyWithoutPlaintext would require an additional round-trip to decrypt the key, and kms:Encrypt violates envelope encryption by sending the payload itself to KMS.
3
Determine the API operation required for the decryption phase.
Identify kms:Decrypt as the API call used to decrypt the stored ciphertext data key back to its plaintext form.
The microservice retrieves the ciphertext key from the DynamoDB item and must call kms:Decrypt before it can decrypt the customer data locally.

Anahtar Kavram

Envelope encryption workflow with AWS KMS
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru