When using the AWS Encryption SDK, how does the developer keep track of the data encryption keys used to encrypt data?
The developer must manually keep track of the data encryption keys used for each data object.
The SDK encrypts the data encryption key and stores it (encrypted) as part of the returned ciphertext.
The SDK stores the data encryption keys automatically in Amazon S3.
The data encryption key is stored in the Userdata for the EC2 instance.
Explanations:
Manually tracking data encryption keys can lead to security risks and management challenges. The AWS Encryption SDK is designed to abstract key management tasks to simplify encryption processes.
The AWS Encryption SDK automatically encrypts the data encryption key (DEK) using a key encryption key (KEK) and includes the encrypted DEK as part of the ciphertext. This ensures secure key management without the developer needing to track DEKs manually.
The AWS Encryption SDK does not automatically store data encryption keys in Amazon S3. Key management is handled within the SDK itself, not through external storage services.
Storing data encryption keys in EC2 instance userdata is not secure or standard practice. Userdata is often accessible to anyone with access to the instance and should not be used for sensitive key storage.
I believe the answer is:
The SDK encrypts the data encryption key and stores it (encrypted) as part of the returned ciphertext.