When using the AWS Encryption SDK, how does the developer keep track of the data encryption keys used to encrypt data?
The developer must manually keep track of the data encryption keys used for each data object.
The SDK encrypts the data encryption key and stores it (encrypted) as part of the returned ciphertext.
The SDK stores the data encryption keys automatically in Amazon S3.
The data encryption key is stored in the Userdata for the EC2 instance.
Explanations:
The AWS Encryption SDK manages the data encryption keys (DEKs) for you. You do not have to manually track them.
The AWS Encryption SDK encrypts the data encryption key (DEK) and stores it as part of the returned ciphertext.
The SDK does not store DEKs in Amazon S3. It only manages the encryption and decryption of the DEK.
The data encryption key is not stored in EC2 instance userdata; it is managed by the SDK and stored securely.
If I’m not mistaken, the answer is:
The SDK encrypts the data encryption key and stores it (encrypted) as part of the returned ciphertext.