Working of MetaStore and MostRecentProvider in Dynamo Db Encryption Client

0

I'm exploring KMS for implementing client-side encryption within our Dynamo DB table. While going through the documentation, it's apparent that the MostRecentProvider (MRP) stands out as the favored choice for high-throughput clients. It seems that MRP leverages a MetaStore to store dataKeys, also referred to as "material," with these dataKeys being encrypted using KMS. When the DynamoDB Encryption Client needs to encrypt an item in the DynamoDB, it initially checks the Cache for the most recent dataKeys version. If absent, a call to KMS is made through the meta store.

Despite having a general understanding of this process, few points still elude me:

  1. I'm uncertain about the necessity of the MetaStore. Why can't MRP directly communicate with KMS to acquire the dataKeys? More component means more ops load/point of failure ?
  2. I'm seeking clarity on the generation of dataKeys stored within the MetaStore. Could there be two distinct types of KMS Keys involved? One dedicated to encrypting/decrypting MetaStore items, and another responsible for creating the MetaStore item itself, essentially used in the encryption/decryption of DynamoDB items.
  3. Who controls the rotation of dataKeys stores in MetaStore? I read somewhere it has be a manual rotation. If so, what should be the frequency of doing it?
  4. If we are creating our own MetaStore (another dynamo db table), will we have to create KMS keys for it?

Thanks

已提问 9 个月前141 查看次数
没有答案

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则