|
Beginning at present, you should use your personal AWS Key Administration Service (AWS KMS) keys to encrypt identification knowledge, equivalent to consumer and group attributes, saved in AWS IAM Identification Heart group cases.
Many organizations working in regulated industries want full management over encryption key administration. Whereas Identification Heart already encrypts knowledge at relaxation utilizing AWS-owned keys, some clients require the flexibility to handle their very own encryption keys for audit and compliance functions.
With this launch, now you can use customer-managed KMS keys (CMKs) to encrypt Identification Heart identification knowledge at relaxation. CMKs offer you full management over the important thing lifecycle, together with creation, rotation, and deletion. You possibly can configure granular entry controls to keys with AWS Key Administration Service (AWS KMS) key insurance policies and IAM insurance policies, serving to to make sure that solely licensed principals can entry your encrypted knowledge. At launch time, the CMK should reside in the identical AWS account and Area as your IAM Identification Heart occasion. The mixing between Identification Heart and KMS gives detailed AWS CloudTrail logs for auditing key utilization and helps meet regulatory compliance necessities.
Identification Heart helps each single-Area and multi-Area keys to match your deployment wants. Whereas Identification Heart cases can at present solely be deployed in a single Area, we suggest utilizing multi-Area AWS KMS keys until your organization insurance policies limit you to single-Area keys. Multi-Area keys present constant key materials throughout Areas whereas sustaining impartial key infrastructure in every Area. This provides you extra flexibility in your encryption technique and helps future-proof your deployment.
Let’s get began
Let’s think about I need to use a CMK to encrypt the identification knowledge of my Identification Heart group occasion. My group makes use of Identification Heart to present staff entry to AWS managed functions, equivalent to Amazon Q Enterprise or Amazon Athena.
As of at present, some AWS managed functions can’t be used with Identification Heart configured with a buyer managed KMS key. See AWS managed functions that you should use with Identification Heart to maintain you up to date with the ever evolving record of suitable functions.
The high-level course of requires first to create a symmetric buyer managed key (CMK) in AWS KMS. The important thing should be configured for encrypt and decrypt operations. Subsequent, I configure the important thing insurance policies to grant entry to Identification Heart, AWS managed functions, directors, and different principals who want entry the Identification Heart and IAM Identification Heart service APIs. Relying in your utilization of Identification Heart, you’ll need to outline completely different insurance policies for the important thing and IAM insurance policies for IAM principals. The service documentation has extra particulars that will help you cowl the commonest use instances.
This demo is in three elements. I first create a buyer managed key in AWS KMS and configure it with permissions that may authorize Identification Heart and AWS managed functions to make use of it. Second, I replace the IAM insurance policies for the principals that may use the important thing from one other AWS account, equivalent to AWS functions directors. Lastly, I configure Identification Heart to make use of the important thing.
Half 1: Create the important thing and outline permissions
First, let’s create a brand new CMK in AWS KMS.
The important thing should be in the identical AWS Area and AWS account because the Identification Heart occasion. You need to create the Identification Heart occasion and the important thing within the administration account of your group inside AWS Group.
I navigate to the AWS Key Administration Service (AWS KMS) console in the identical Area as my Identification Heart occasion, then I select Create a key. This launches me into the important thing creation wizard.
Below Step 1–Configure key, I choose the important thing kind–both Symmetric (a single key used for each encryption and decryption) or Uneven (a public-private key pair for encryption/decryption and signing/verification). Identification Heart requires symmetric keys for encryption at relaxation. I choose Symmetric.
For key utilization, I choose Encrypt and decrypt which permits the important thing for use just for encrypting and decrypting knowledge.
Below Superior choices, I choose KMS – advisable for Key materials origin, so AWS KMS creates and manages the important thing materials.
For Regionality, I select between Single-Area or Multi-Area key. I choose Multi-Area key to permit key directors to duplicate the important thing to different Areas. As defined already, Identification Heart doesn’t require this at present nevertheless it helps to future-proof your configuration. Bear in mind which you can not rework a single-Area key to a multi-Area one after its creation (however you possibly can change the important thing utilized by Identification Heart).
Then, I select Subsequent to proceed with further configuration steps, equivalent to including labels, defining administrative permissions, setting utilization permissions, and reviewing the ultimate configuration earlier than creating the important thing.
Below Step 2–Add Labels, I enter an Alias identify for my key and choose Subsequent.
On this demo, I’m modifying the important thing coverage by including coverage statements utilizing templates supplied within the documentation. I skip Step 3 and Step 4 and navigate to Step 5–Edit key coverage.
Identification Heart requires, on the minimal, permissions permitting Identification Heart and its directors to make use of the important thing. Subsequently, I add three coverage statements, the primary and second authorize the directors of the service, the third one to authorize the Identification Heart service itself.
{
"Model": "2012-10-17",
"Id": "key-consolepolicy-3",
"Assertion": [
{
"Sid": "Allow_IAMIdentityCenter_Admin_to_use_the_KMS_key_via_IdentityCenter_and_IdentityStore",
"Effect": "Allow",
"Principal": {
"AWS": "ARN_OF_YOUR_IDENTITY_CENTER_ADMIN_IAM_ROLE"
},
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Useful resource": "*",
"Situation": {
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com",
"identitystore.*.amazonaws.com"
]
}
}
},
{
"Sid": "Allow_IdentityCenter_admin_to_describe_the_KMS_key",
"Impact": "Permit",
"Principal": {
"AWS": "ARN_OF_YOUR_IDENTITY_CENTER_ADMIN_IAM_ROLE"
},
"Motion": "kms:DescribeKey",
"Useful resource": "*"
},
{
"Sid": "Allow_IdentityCenter_and_IdentityStore_to_use_the_KMS_key",
"Impact": "Permit",
"Principal": {
"Service": [
"sso.amazonaws.com",
"identitystore.amazonaws.com"
]
},
"Motion": [
"kms:Decrypt",
"kms:ReEncryptTo",
"kms:ReEncryptFrom",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Useful resource": "*",
"Situation": {
"StringEquals": {
"aws:SourceAccount": ""
}
}
},
{
"Sid": "Allow_IdentityCenter_and_IdentityStore_to_describe_the_KMS_key",
"Impact": "Permit",
"Principal": {
"Service": [
"sso.amazonaws.com",
"identitystore.amazonaws.com"
]
},
"Motion": [
"kms:DescribeKey"
],
"Useful resource": "*"
}
]
} I even have so as to add further coverage statements to permit my use case: using AWS managed functions. I add these two coverage statements to authorize AWS managed functions and their directors to make use of the KMS key. The doc lists further use instances and their respective insurance policies.
{
"Sid": "Allow_AWS_app_admins_in_the_same_AWS_organization_to_use_the_KMS_key",
"Impact": "Permit",
"Principal": "*",
"Motion": [
"kms:Decrypt"
],
"Useful resource": "*",
"Situation": {
"StringEquals" : {
"aws:PrincipalOrgID": "MY_ORG_ID (format: o-xxxxxxxx)"
},
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com", "identitystore.*.amazonaws.com"
]
}
}
},
{
"Sid": "Allow_managed_apps_to_use_the_KMS_Key",
"Impact": "Permit",
"Principal": "*",
"Motion": [
"kms:Decrypt"
],
"Useful resource": "*",
"Situation": {
"Bool": { "aws:PrincipalIsAWSService": "true" },
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com", "identitystore.*.amazonaws.com"
]
},
"StringEquals": { "aws:SourceOrgID": "MY_ORG_ID (format: o-xxxxxxxx)" }
}
}You possibly can additional limit the important thing utilization to a selected Identification Heart occasion, particular software cases, or particular software directors. The documentation accommodates examples of superior key insurance policies in your use instances.
To assist shield towards IAM position identify adjustments when permission units are recreated, use the method described within the Customized belief coverage instance.
Half 2: Replace IAM insurance policies to permit use of the KMS key from one other AWS account
Any IAM principal that makes use of the Identification Heart service APIs from one other AWS account, equivalent to Identification Heart delegated directors and AWS software directors, want an IAM coverage assertion that enables use of the KMS key through these APIs.
I grant permissions to entry the important thing by creating a brand new coverage and attaching the coverage to the IAM position related for my use case. It’s also possible to add these statements to the prevailing identity-based insurance policies of the IAM position.
To take action, after the secret’s created, I find its ARN and change the key_ARNwithin the template under. Then, I connect the coverage to the managed software administrator IAM principal. The documentation additionally covers IAM insurance policies that grants Identification Heart delegated directors permissions to entry the important thing.
Right here is an instance for managed software directors:
{
"Sid": "Allow_app_admins_to_use_the_KMS_key_via_IdentityCenter_and_IdentityStore",
"Impact": "Permit",
"Motion":
"kms:Decrypt",
"Useful resource": "",
"Situation": {
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com",
"identitystore.*.amazonaws.com"
]
}
}
} The documentation shares IAM insurance policies template for the commonest use instances.
Half 3: Configure IAM Identification Heart to make use of the important thing
I can configure a CMK both throughout the enablement of an Identification Heart group occasion or on an present occasion, and I can change the encryption configuration at any time by switching between CMKs or reverting to AWS-owned keys.
Please observe that an incorrect configuration of KMS key permissions can disrupt Identification Heart operations and entry to AWS managed functions and accounts by way of Identification Heart. Proceed fastidiously to this ultimate step and guarantee you could have learn and understood the documentation.
After I’ve created and configured my CMK, I can choose it beneath Superior configuration when enabling Identification Heart.
To configure a CMK on an present Identification Heart occasion utilizing the AWS Administration Console, I begin by navigating to the Identification Heart part of the AWS Administration Console. From there, I choose Settings from the navigation pane, then I choose the Administration tab, and choose Handle encryption within the Key for encrypting IAM Identification Heart knowledge at relaxation part.
At any time, I can choose one other CMK from the identical AWS Account, or swap again to an AWS-managed key.
After selecting Save, the important thing change course of takes a number of seconds to finish. All service functionalities proceed uninterrupted throughout the transition. If, for no matter causes, Identification Heart can’t entry the brand new key, an error message shall be returned and Identification Heart will proceed to make use of the present key, protecting your identification knowledge encrypted with the mechanism it’s already encrypted with.
Issues to remember
The encryption key you create turns into a vital element of your Identification Heart. Once you select to make use of your personal managed key to encrypt identification attributes at relaxation, it’s a must to confirm the next factors.
- Have you ever configured the required permissions to make use of the KMS key? With out correct permissions, enabling the CMK might fail or disrupt IAM Identification Heart administration and AWS managed functions.
- Have you ever verified that your AWS managed functions are suitable with CMK keys? For a listing of suitable functions, see AWS managed functions that you should use with IAM Identification Heart. Enabling CMK for Identification Heart that’s utilized by AWS managed functions incompatible with CMK will end in operational disruption for these functions. When you have incompatible functions, don’t proceed.
- Is your group utilizing AWS managed functions that require further IAM position configuration to make use of the Identification Heart and Identification Retailer APIs? For every such AWS managed software that’s already deployed, examine the managed software’s Consumer Information for up to date KMS key permissions for IAM Identification Centre utilization and replace them as instructed to forestall software disruption.
- For brevity, the KMS key coverage statements on this submit omit the encryption context, which permits you to limit using the KMS key to Identification Heart together with a selected occasion. To your manufacturing eventualities, you possibly can add a situation like this for Identification Heart:
"Situation": { "StringLike": { "kms:EncryptionContext:aws:sso:instance-arn": "${identity_center_arn}", "kms:ViaService": "sso.*.amazonaws.com" } }or this for Identification Retailer:
"Situation": { "StringLike": { "kms:EncryptionContext:aws:identitystore:identitystore-arn": "${identity_store_arn}", "kms:ViaService": "identitystore.*.amazonaws.com" } }
Pricing and availability
Normal AWS KMS costs apply for key storage and API utilization. Identification Heart stays accessible at no further price.
This functionality is now accessible in all AWS industrial Areas, AWS GovCloud (US), and AWS China Areas. To be taught extra, go to the IAM Identification Heart Consumer Information.
We stay up for studying how you employ this new functionality to fulfill your safety and compliance necessities.