Question

A developer builds a Lambda function that stores encrypted customer records in DynamoDB using envelope encryption. When writing, the function calls KMS GenerateDataKey to get a plaintext data key and an encrypted data key, encrypts the record locally with the plaintext key, and stores both the ciphertext and the encrypted data key in DynamoDB. To later read a record, what must the function do to recover the plaintext?

Accepted Answer

Call KMS Decrypt with the stored encrypted data key to obtain the plaintext data key, then use it to decrypt the record ciphertext locally.

Answer

Call KMS GenerateDataKey again to produce a new plaintext data key and use it to decrypt the stored ciphertext.

Answer

Call KMS Decrypt directly on the record ciphertext stored in DynamoDB using the CMK's key ID.

Answer

Store the plaintext data key in the Lambda environment variables so it can be reused for decryption without another KMS call.