An application fetches sensitive data from a third-party system and formats it into a PDF larger than 1 MB. The developer will encrypt the file on disk using a KMS symmetric customer-managed key and later decrypt it for download. Using the GenerateDataKey API, which approach correctly enables encrypting the PDF so it can be decrypted later?

The correct approach involves using the plaintext data key returned by GenerateDataKey to encrypt the large PDF file locally with a symmetric algorithm. This plaintext key is ephemeral and should be used immediately, then securely discarded from memory. The encrypted (ciphertext) data key, also returned by GenerateDataKey, is then saved alongside the encrypted PDF. To decrypt the file later, the stored encrypted data key is passed to KMS's Decrypt API, which returns the plaintext data key. This plaintext key can then be used to decrypt the PDF. Incorrect options suggest saving the plaintext key to disk, which is a security vulnerability, or using the KMS Encrypt API for the large file, which is inefficient and not its intended use for large data. KMS is designed to encrypt small data keys, not large data files directly.