Examkin

Soru

Zorluk: OrtaAWS KMS and Encryption

A developer is implementing a security feature for a web application to encrypt sensitive transaction records using an AWS KMS customer managed key (CMK). During the `Encrypt` API call, the developer passes the transaction ID as part of the encryption context: `{"TransactionID": "TX-98765"}`. During a scheduled audit, an offline compliance service attempts to decrypt the transaction records using the AWS SDK. The service's IAM role has full permissions to call `kms:Decrypt` on the CMK, but the decryption requests fail with an `InvalidCiphertextException`. How should the developer resolve this issue?

  1. Ensure that the compliance service includes the exact encryption context `{"TransactionID": "TX-98765"}` in its `Decrypt` API request.Cevap
  2. B
    Update the KMS key policy of the customer managed key to permit the compliance service to bypass the encryption context verification.
  3. C
    Store the encryption context value in AWS Systems Manager Parameter Store as a secure string and reference it in the service's IAM policy.
  4. D
    Call the `ReEncrypt` API to move the ciphertext to a different customer managed key that does not require an encryption context.

Cevap

Ensure that the compliance service includes the exact encryption context `{"TransactionID": "TX-98765"}` in its `Decrypt` API request.
The encryption context in AWS KMS acts as additional authenticated data (AAD) and is cryptographically bound to the ciphertext. To decrypt the data, the exact same encryption context (key-value pair) must be provided in the Decrypt API request. Without it, KMS cannot verify the integrity of the ciphertext and returns an InvalidCiphertextException.

Adım Adım Çözüm

1
Analyze the error: `InvalidCiphertextException` when attempting to decrypt.
Identify that the key-value pair `{"TransactionID": "TX-98765"}` was provided as an encryption context during the `Encrypt` operation.
Any data encrypted with an encryption context requires the same context to be passed during decryption.
2
Review the API documentation for AWS KMS `Decrypt` operation.
Confirm that the `EncryptionContext` parameter must be supplied and match the one used during encryption.
The encryption context is bound as Additional Authenticated Data (AAD) to the ciphertext.
3
Configure the compliance service's decryption request to pass the `EncryptionContext` parameter.
The KMS `Decrypt` call succeeds, returning the plaintext record.
Matching the encryption context allows KMS to cryptographically authenticate and decrypt the payload.

Anahtar Kavram

AWS KMS Encryption Context behaves as Additional Authenticated Data (AAD) that must match exactly during decryption operations.
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru