AWS DVA-C02 Drill: Client-Side Encryption - Proper Use of KMS Data Keys

Jeff’s Note

#

Unlike generic exam dumps, ADH analyzes this scenario through the lens of a Real-World Lead Developer.

For AWS DVA-C02 candidates, the confusion often lies in how to correctly protect sensitive data client-side with KMS without reusing encryption keys. In production, this is about knowing exactly how to leverage the KMS GenerateDataKey API for secure, unique file encryption keys and manage encrypted data keys properly. Let’s drill down.

The Certification Drill (Simulated Question)

#

Scenario

#

DeltaStream Media, a fast-growing video startup, is developing a new application to securely store hundreds of unique video files. Each video file must be encrypted within the application before storage, using a distinct encryption key per video for enhanced security. The application should manage encryption keys efficiently while minimizing overhead and maintaining compliance with best practices for client-side encryption.

The Requirement:

#

How should the lead developer implement the encryption logic in the application to meet these requirements?

The Options

#

• A) Use the AWS KMS Encrypt API to encrypt the raw video data directly. Store both the encrypted data and metadata.
• B) Use a third-party cryptography library to generate a single encryption key for the entire application and encrypt all videos with it. Store only the encrypted data.
• C) Use the AWS KMS GenerateDataKey API to generate a unique data key per video. Use this data key to encrypt the video data locally, then store both the encrypted data key and the encrypted video.
• D) Upload all video files to an Amazon S3 bucket configured with Server-Side Encryption using an AWS KMS key (SSE-KMS).

Google adsense

#

leave a comment:

Correct Answer

#

C.

Quick Insight: The Developer (DVA-C02) Imperative

#

Using the GenerateDataKey API is critical because it returns a plaintext data key for encrypting application data and an encrypted copy of that data key that can be safely stored. This enables efficient, secure client-side encryption with unique keys, avoids reusing keys across files, and leverages KMS for key management without exposing keys unnecessarily.

Content Locked: The Expert Analysis

#

You’ve identified the answer. But do you know the implementation details that separate a Junior from a Senior?

The Expert’s Analysis

#

Correct Answer

#

Option C

The Winning Logic

#

The correct pattern for encrypting unique files client-side in an AWS environment involves:

• Calling GenerateDataKey in AWS KMS, which provides two returned values:
  a) The plaintext data key (to encrypt the video locally)
  b) The encrypted data key (to store alongside encrypted data for future decryption)

• Encrypting each video with its own unique, plaintext data key instance in the application layer ensures unique encryption per file, enhancing security and allowing granular key management.

• Storing the encrypted data key with the encrypted video enables secure retrieval and decryption without storing plaintext keys or hardcoding keys in the app.

The Trap (Distractor Analysis):

#

• Why not Option A?
  The KMS Encrypt API encrypts small payloads directly, but video files are large and performance-inefficient if encrypted with KMS itself. Also, it would not provide a unique key per file unless combined with GenerateDataKey, which is missing here.

• Why not Option B?
  Managing key generation solely with a cryptographic library means no integration with AWS KMS for centralized key management or compliance, risking key exposure. Also, using a single key for all videos violates the requirement for unique keys per video.

• Why not Option D?
  Server-Side Encryption with KMS (SSE-KMS) secures data on S3, but in this scenario, files must be encrypted before storage (client-side encryption). SSE-KMS manages encryption only after upload, so it doesn’t meet the requirement for application-controlled per-file encryption keys.

The Technical Blueprint

#

B) For Developer (Code/CLI Snippet):

#

import boto3
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
import os

kms_client = boto3.client('kms')

def encrypt_video(video_bytes, kms_key_id):
    # Generate a unique data key
    response = kms_client.generate_data_key(KeyId=kms_key_id, KeySpec='AES_256')

    plaintext_data_key = response['Plaintext']
    encrypted_data_key = response['CiphertextBlob']

    # Encrypt the video data locally using AES-256-GCM or similar
    iv = os.urandom(12)
    encryptor = Cipher(algorithms.AES(plaintext_data_key), modes.GCM(iv)).encryptor()
    encrypted_video = encryptor.update(video_bytes) + encryptor.finalize()
    tag = encryptor.tag

    # Store encrypted_video, encrypted_data_key, iv, and tag together safely
    return {
        'EncryptedVideo': encrypted_video,
        'EncryptedDataKey': encrypted_data_key,
        'IV': iv,
        'Tag': tag
    }

The Comparative Analysis

#

Real-World Application (Practitioner Insight)

#

Exam Rule

#

“For the DVA exam, always choose GenerateDataKey API when the requirement includes client-side encryption with unique keys per object.”

Real World

#

“In reality, many secure applications combine KMS with an envelope encryption pattern exactly as in option C—balancing performance with robust key management, making it the de facto approach for sensitive video or large binary data encryption.”

(CTA) Stop Guessing, Start Mastering

#

Disclaimer

This is a study note based on simulated scenarios for the AWS DVA-C02 exam.