As a programmer, you have been hired to develop an application for a company. The application needs to first encrypt the data at the client side before sending it to a destination location. How can you achieve this? The size of the data is generally around 1 – 4 MB. Each object needs to have its own key to encrypt the data.

Answer options:

A.Upload the data to KMS and use the CMK key to encrypt the data.
B.Use the CMK key ARN to get the key and encrypt the data.
C.Use the GenerateDataKey API to get the key from a CMK.
D.Upload the data to an S3 bucket with encryption enabled.

Answer – C
The AWS Documentation mentions the following.
We recommend that you use the following pattern to encrypt data locally in your application.
Use this operation (GenerateDataKey) to get a data encryption key.
Use the plaintext data encryption key (returned in the Plaintext field of the response) to encrypt data locally, then erase the plaintext data key from memory.
Store the encrypted data key (returned in the CiphertextBlob field of the response) alongside the locally encrypted data.
Option A is incorrect since you don’t upload the data to KMS to encrypt it.
Option B is incorrect since you don’t use the CMK key to encrypt large data objects.
Option D is incorrect since the data would only be encrypted at rest, and the question states that the object needs to be encrypted at the client side.
For more information on the Generate Data Key API, please refer to the below URL-
https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html