A parks registration app must protect date-of-birth fields with application-level encryption while still using AWS KMS for key custody. Which pattern should the architect design?
Select an answer to reveal the explanation.
Short Explanation
Envelope encryption is a lockbox inside a lockbox: KMS hands you a data key, you encrypt the DOB locally, and you stash the wrapped key with the data. Plaintext env vars and public topics are how PII leaks, not how you protect it.
Full Explanation
Envelope encryption uses KMS to generate and wrap data keys while the application encrypts sensitive fields with those data keys, minimizing exposure of long-lived master keys. Storing plaintext DOB in environment variables, publishing to public topics, or relying solely on network isolation without cryptographic controls fails application-level field protection requirements.