Examkin

Soru

Zorluk: ZorAWS KMS and Encryption

A developer is designing a security solution for a document archiving system. The application must encrypt PDF documents, each averaging 18 MB18\text{ MB} in size, before uploading them to an Amazon S3 bucket. A Customer Managed Key (CMK) in AWS KMS will be used to protect the data. A separate reader application running on Amazon ECS must download these documents from S3 and decrypt them. Which TWO actions must the developer perform to implement this workflow using the AWS SDK and AWS KMS under the principle of least privilege?

  1. In the writer application, call the KMS GenerateDataKey API operation to retrieve both a plaintext data key and a ciphertext data key. Encrypt the PDF file locally using the plaintext data key, delete the plaintext key from memory, and upload the encrypted PDF along with the ciphertext data key to Amazon S3.Cevap
  2. In the reader application's IAM policy, grant the kms:Decrypt permission on the KMS CMK. Download the encrypted PDF and the ciphertext data key from Amazon S3, call the KMS Decrypt API operation with the ciphertext data key to retrieve the plaintext data key, and decrypt the PDF locally.Cevap
  3. C
    In the writer application, call the KMS Encrypt API operation directly, passing the PDF payload and the KMS CMK ARN to perform server-side encryption before uploading the encrypted bytes to Amazon S3.
  4. D
    In the writer application's IAM policy, grant the kms:Encrypt permission on the KMS CMK. Call the KMS GenerateDataKeyWithoutPlaintext API operation to obtain the ciphertext data key, call the KMS Decrypt API operation to retrieve the plaintext key for local encryption, and store the file in S3.
  5. E
    In the reader application's IAM policy, grant the kms:GenerateDataKey and kms:ReEncrypt permissions on the KMS CMK. Download the encrypted PDF and use the KMS ReEncrypt API operation to decrypt the file locally.

Cevap

The developer must configure the writer application to call the KMS GenerateDataKey API operation to retrieve the plaintext and ciphertext data keys, encrypt the file locally, and delete the plaintext key from memory. Additionally, the developer must grant the reader application's IAM role the kms:Decrypt permission to decrypt the ciphertext data key via the KMS Decrypt API operation to retrieve the plaintext data key.
To encrypt payloads larger than 4 KB4\text{ KB} like the 18 MB18\text{ MB} PDFs, client-side envelope encryption must be used. The writer calls GenerateDataKey on the Customer Managed Key (CMK), getting both plaintext and ciphertext versions of the data key. It encrypts the PDF locally with the plaintext data key and then discards it. The ciphertext data key is saved alongside the encrypted file in S3. The reader downloads the encrypted PDF and the ciphertext data key, calls Decrypt to retrieve the plaintext data key, and then decrypts the PDF locally. Under the principle of least privilege, the reader only needs kms:Decrypt permission.

Adım Adım Çözüm

1
Evaluate the file size against AWS KMS limitations.
Since the average PDF file size is 18 MB18\text{ MB} and the direct KMS Encrypt API maximum limit is 4 KB4\text{ KB}, the developer must use client-side envelope encryption.
Direct KMS encryption cannot handle large payloads, necessitating the generation of local data keys.
2
Determine the proper writer application API calls and IAM permissions.
The writer application must call GenerateDataKey (which requires kms:GenerateDataKey permission) to get both plaintext and ciphertext data keys, encrypt the payload with the plaintext key, delete the plaintext key, and store the ciphertext key with the encrypted file.
This implements standard client-side envelope encryption and minimizes key exposure.
3
Determine the proper reader application API calls and IAM permissions.
The reader application must download the encrypted PDF and the ciphertext key, call the Decrypt API (requiring kms:Decrypt permission) to decrypt the ciphertext key, and then decrypt the PDF locally.
To decrypt, only the ciphertext data key needs to be decrypted via KMS. The main document decryption happens locally.

Anahtar Kavram

Client-side envelope encryption with AWS KMS
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru