Verdant Bioinformatics encrypts large research files produced by their ETL jobs and is hitting AWS KMS request throttling and rising costs. They want to adopt an envelope encryption pattern to reduce KMS API usage while maintaining strong security. Which two actions should they implement? (Choose two.)

The correct actions implement envelope encryption, a standard practice for large data sets with KMS. Generating a data key with GenerateDataKey provides both a plaintext key for local encryption and an encrypted version (CiphertextBlob) for secure storage. This reduces KMS calls because the actual file encryption happens locally, not within KMS. For decryption, KMS Decrypt is used only on the stored encrypted data key to retrieve the plaintext data key, which then decrypts the file locally. This minimizes KMS API usage compared to encrypting/decrypting each file directly with KMS. Incorrect options: Saving the plaintext data key alongside the ciphertext would compromise security, as anyone with access to the encrypted file could also access the key to decrypt it. Using an asymmetric RSA key and kms:Encrypt for each file, or calling KMS Encrypt with entire file contents, would lead to even higher KMS API usage and costs, directly contradicting the goal of reducing KMS throttling and costs.