An integrated OCI service stores a citizen document using Vault envelope encryption. What is stored next to the ciphertext, and why must the app call Vault to read it?
Select an answer to reveal the explanation.
Short Explanation
Lock the document with a padlock (DEK), then lock that padlock’s key with the vault master key. Only the wrapped DEK sits with the file—so opening it means calling Vault under IAM.
Full Explanation
With Vault envelope encryption for a citizen document, the integrated service encrypts the payload with a data encryption key, encrypts that DEK with a vault master key, and stores the ciphertext together with the wrapped DEK—not the plaintext master key. Reading the document therefore requires calling Vault under IAM to unwrap the DEK before local decrypt. That design keeps long-lived master material in the vault while allowing object storage to hold only ciphertext and wrapped key material.
Writing both the plaintext master key and plaintext DEK beside the object in Object Storage fails by concept: it destroys the point of envelope encryption and exposes decrypt capability to anyone who can read the object. Storing only an unwrapped DEK in the bucket so any anonymous reader can decrypt without IAM fails for the same reason—unwrap must be gated by Vault and IAM on the master key. Storing nothing cryptographic and re-deriving keys from the object name alone fails cryptographically and operationally: object names are not secret key material and offer no IAM-gated unwrap step.
Exam caveat: beside the ciphertext you keep the wrapped DEK; plaintext keys never ride along in the bucket. Operational check: inspect a stored object’s companion metadata or sidecar and confirm only wrapped DEK material is present; revoke IAM on the master key and confirm decrypt fails even when ciphertext is readable.