Question

A developer needs to encrypt several 500 MB files client-side before uploading them to Amazon S3. The application uses an AWS KMS customer managed key. The developer wants to minimize the number of KMS API calls and avoid sending the large file contents to the KMS service (KMS request payloads are limited to 4 KB). Which approach should the developer implement?

Accepted Answer

Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted data key, use the plaintext key locally to encrypt the file, then store the encrypted data key alongside the ciphertext and discard the plaintext key from memory.

Answer

Call the KMS Encrypt API directly with the file contents as the payload, passing the customer managed key ID to encrypt each file.

Answer

Enable S3 server-side encryption with SSE-KMS on the bucket and upload the plaintext files so S3 encrypts them automatically.

Answer

Call GenerateDataKeyWithoutPlaintext to get an encrypted data key, then upload the file and the encrypted key together, letting S3 decrypt the key when needed.