The same KMS key protects several datasets.
A role must not decrypt ciphertext belonging to another dataset.
Which protection approach is most appropriate?
Require a dataset attribute in the KMS EncryptionContext and enforce it in policy conditions.
Detailed explanation
Encryption and decryption succeed only when the authenticated context matches.
Encryption and decryption succeed only when the authenticated context matches.
Audit logs are not automatically supplied as encryption context.
Audit logs are not automatically supplied as encryption context.
KMS key material must never be published.
KMS key material must never be published.
KMS does not automatically treat a file name as an authorization condition.
KMS does not automatically treat a file name as an authorization condition.
Check official documentation
Compare the following points with the official documentation.
AWS KMS encryption context、kms:EncryptionContext条件、GenerateDataKeyの公式説明を確認する。
What to confirm
ファイル名・キー分離と、EncryptionContextによる暗号文の用途束縛の違いを説明できる。
Key points
- EncryptionContext
- KMS condition
- Dataset binding
- Decryption
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Authenticated context
A mismatched context causes KMS decryption to fail.
Implementation consistency
Keep key names, values, and case identical and never put secrets in context.