Question

A developer is building a Lambda function that must encrypt payment records that are typically 1–2 MB in size before storing them in Amazon S3. The team wants to use a customer managed KMS key but has learned that the KMS Encrypt API rejects the payloads. What is the recommended approach to encrypt the large records using KMS?

Accepted Answer

Call KMS GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the record locally with the plaintext key, then discard the plaintext key and store the encrypted data key alongside the ciphertext.

Answer

Split each record into 4 KB chunks and call the KMS Encrypt API repeatedly for each chunk, then concatenate the ciphertext blocks.

Answer

Request a service quota increase for the KMS Encrypt API payload limit so records up to 2 MB can be encrypted directly.

Answer

Enable automatic key rotation on the customer managed key, which raises the maximum payload size the Encrypt API accepts.