A company runs a cron job on an Amazon EC2 instance on a predefined schedule...

Generate a Data Key:

Use theaws kms generate-data-keycommand to request a data key from AWS KMS.

The data key will include both a plaintext version and an encrypted version.

Example command:

bash

aws kms generate-data-key --key-id --key-spec AES_256

Encrypt the File:

Use the plaintext data key to encrypt the 2 KB file using standard encryption libraries or utilities (e.g., OpenSSL).

Secure the Encrypted Data Key:

Store the encrypted version of the data key alongside the encrypted file for future decryption.

Least Privilege Principle:

Ensure the EC2 instance role has the minimum necessary permissions to callkms:GenerateDataKeyandkms:Decrypt.

Testing and Validation:

Verify that the encrypted file can be successfully decrypted using the stored encrypted data key and the KMS key.

AWS KMS GenerateDataKey API

AWS KMS Best Practices

Encrypting Data with AWS KMS