 |
Beginning at the moment, you need to use your personal AWS Key Administration Service (AWS KMS) keys to encrypt identification information, comparable to consumer and group attributes, saved in AWS IAM Id Middle group cases.
Many organizations working in regulated industries want full management over encryption key administration. Whereas Id Middle already encrypts information at relaxation utilizing AWS-owned keys, some clients require the power to handle their very own encryption keys for audit and compliance functions.
With this launch, now you can use customer-managed KMS keys (CMKs) to encrypt Id Middle identification information at relaxation. CMKs give you full management over the important thing lifecycle, together with creation, rotation, and deletion. You’ll be able to configure granular entry controls to keys with AWS Key Administration Service (AWS KMS) key insurance policies and IAM insurance policies, serving to to make sure that solely licensed principals can entry your encrypted information. At launch time, the CMK should reside in the identical AWS account and Area as your IAM Id Middle occasion. The mixing between Id Middle and KMS supplies detailed AWS CloudTrail logs for auditing key utilization and helps meet regulatory compliance necessities.
Id Middle helps each single-Area and multi-Area keys to match your deployment wants. Whereas Id Middle cases can presently solely be deployed in a single Area, we advocate utilizing multi-Area AWS KMS keys except your organization insurance policies limit you to single-Area keys. Multi-Area keys present constant key materials throughout Areas whereas sustaining impartial key infrastructure in every Area. This offers you extra flexibility in your encryption technique and helps future-proof your deployment.
Let’s get began
Let’s think about I need to use a CMK to encrypt the identification information of my Id Middle group occasion. My group makes use of Id Middle to provide staff entry to AWS managed functions, comparable to Amazon Q Enterprise or Amazon Athena.
As of at the moment, some AWS managed functions can’t be used with Id Middle configured with a buyer managed KMS key. See AWS managed functions that you need to use with Id Middle to maintain you up to date with the ever evolving checklist of suitable functions.
The high-level course of requires first to create a symmetric buyer managed key (CMK) in AWS KMS. The important thing should be configured for encrypt and decrypt operations. Subsequent, I configure the important thing insurance policies to grant entry to Id Middle, AWS managed functions, directors, and different principals who want entry the Id Middle and IAM Id Middle service APIs. Relying in your utilization of Id Middle, you’ll must outline totally different insurance policies for the important thing and IAM insurance policies for IAM principals. The service documentation has extra particulars that can assist you cowl the most typical use circumstances.
This demo is in three components. I first create a buyer managed key in AWS KMS and configure it with permissions that may authorize Id Middle and AWS managed functions to make use of it. Second, I replace the IAM insurance policies for the principals that may use the important thing from one other AWS account, comparable to AWS functions directors. Lastly, I configure Id Middle to make use of the important thing.
Half 1: Create the important thing and outline permissions
First, let’s create a brand new CMK in AWS KMS.
The important thing should be in the identical AWS Area and AWS account because the Id Middle occasion. You could create the Id Middle occasion and the important thing within the administration account of your group inside AWS Group.
I navigate to the AWS Key Administration Service (AWS KMS) console in the identical Area as my Id Middle occasion, then I select Create a key. This launches me into the important thing creation wizard.
Below Step 1–Configure key, I choose the important thing sort–both Symmetric (a single key used for each encryption and decryption) or Uneven (a public-private key pair for encryption/decryption and signing/verification). Id Middle requires symmetric keys for encryption at relaxation. I choose Symmetric.
For key utilization, I choose Encrypt and decrypt which permits the important thing for use just for encrypting and decrypting information.
Below Superior choices, I choose KMS – really useful for Key materials origin, so AWS KMS creates and manages the important thing materials.
For Regionality, I select between Single-Area or Multi-Area key. I choose Multi-Area key to permit key directors to duplicate the important thing to different Areas. As defined already, Id Middle doesn’t require this at the moment but it surely helps to future-proof your configuration. Bear in mind you can not rework a single-Area key to a multi-Area one after its creation (however you possibly can change the important thing utilized by Id Middle).
Then, I select Subsequent to proceed with extra configuration steps, comparable to including labels, defining administrative permissions, setting utilization permissions, and reviewing the ultimate configuration earlier than creating the important thing.
Below Step 2–Add Labels, I enter an Alias identify for my key and choose Subsequent.
On this demo, I’m modifying the important thing coverage by including coverage statements utilizing templates offered within the documentation. I skip Step 3 and Step 4 and navigate to Step 5–Edit key coverage.
Id Middle requires, on the minimal, permissions permitting Id Middle and its directors to make use of the important thing. Due to this fact, I add three coverage statements, the primary and second authorize the directors of the service, the third one to authorize the Id Middle service itself.
{
"Model": "2012-10-17",
"Id": "key-consolepolicy-3",
"Assertion": [
{
"Sid": "Allow_IAMIdentityCenter_Admin_to_use_the_KMS_key_via_IdentityCenter_and_IdentityStore",
"Effect": "Allow",
"Principal": {
"AWS": "ARN_OF_YOUR_IDENTITY_CENTER_ADMIN_IAM_ROLE"
},
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Useful resource": "*",
"Situation": {
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com",
"identitystore.*.amazonaws.com"
]
}
}
},
{
"Sid": "Allow_IdentityCenter_admin_to_describe_the_KMS_key",
"Impact": "Enable",
"Principal": {
"AWS": "ARN_OF_YOUR_IDENTITY_CENTER_ADMIN_IAM_ROLE"
},
"Motion": "kms:DescribeKey",
"Useful resource": "*"
},
{
"Sid": "Allow_IdentityCenter_and_IdentityStore_to_use_the_KMS_key",
"Impact": "Enable",
"Principal": {
"Service": [
"sso.amazonaws.com",
"identitystore.amazonaws.com"
]
},
"Motion": [
"kms:Decrypt",
"kms:ReEncryptTo",
"kms:ReEncryptFrom",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Useful resource": "*",
"Situation": {
"StringEquals": {
"aws:SourceAccount": "<Id Middle Account ID>"
}
}
},
{
"Sid": "Allow_IdentityCenter_and_IdentityStore_to_describe_the_KMS_key",
"Impact": "Enable",
"Principal": {
"Service": [
"sso.amazonaws.com",
"identitystore.amazonaws.com"
]
},
"Motion": [
"kms:DescribeKey"
],
"Useful resource": "*"
}
]
}I even have so as to add extra coverage statements to permit my use case: using AWS managed functions. I add these two coverage statements to authorize AWS managed functions and their directors to make use of the KMS key. The doc lists extra use circumstances and their respective insurance policies.
{
"Sid": "Allow_AWS_app_admins_in_the_same_AWS_organization_to_use_the_KMS_key",
"Impact": "Enable",
"Principal": "*",
"Motion": [
"kms:Decrypt"
],
"Useful resource": "*",
"Situation": {
"StringEquals" : {
"aws:PrincipalOrgID": "MY_ORG_ID (format: o-xxxxxxxx)"
},
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com", "identitystore.*.amazonaws.com"
]
}
}
},
{
"Sid": "Allow_managed_apps_to_use_the_KMS_Key",
"Impact": "Enable",
"Principal": "*",
"Motion": [
"kms:Decrypt"
],
"Useful resource": "*",
"Situation": {
"Bool": { "aws:PrincipalIsAWSService": "true" },
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com", "identitystore.*.amazonaws.com"
]
},
"StringEquals": { "aws:SourceOrgID": "MY_ORG_ID (format: o-xxxxxxxx)" }
}
}You’ll be able to additional limit the important thing utilization to a selected Id Middle occasion, particular utility cases, or particular utility directors. The documentation comprises examples of superior key insurance policies on your use circumstances.
To assist defend in opposition to IAM position identify adjustments when permission units are recreated, use the method described within the Customized belief coverage instance.
Half 2: Replace IAM insurance policies to permit use of the KMS key from one other AWS account
Any IAM principal that makes use of the Id Middle service APIs from one other AWS account, comparable to Id Middle delegated directors and AWS utility directors, want an IAM coverage assertion that permits use of the KMS key through these APIs.
I grant permissions to entry the important thing by creating a brand new coverage and attaching the coverage to the IAM position related for my use case. You may also add these statements to the present identity-based insurance policies of the IAM position.
To take action, after the secret’s created, I find its ARN and substitute the key_ARNwithin the template beneath. Then, I connect the coverage to the managed utility administrator IAM principal. The documentation additionally covers IAM insurance policies that grants Id Middle delegated directors permissions to entry the important thing.
Right here is an instance for managed utility directors:
{
"Sid": "Allow_app_admins_to_use_the_KMS_key_via_IdentityCenter_and_IdentityStore",
"Impact": "Enable",
"Motion":
"kms:Decrypt",
"Useful resource": "<key_ARN>",
"Situation": {
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com",
"identitystore.*.amazonaws.com"
]
}
}
}The documentation shares IAM insurance policies template for the most typical use circumstances.
Half 3: Configure IAM Id Middle to make use of the important thing
I can configure a CMK both throughout the enablement of an Id Middle group occasion or on an present occasion, and I can change the encryption configuration at any time by switching between CMKs or reverting to AWS-owned keys.
Please be aware that an incorrect configuration of KMS key permissions can disrupt Id Middle operations and entry to AWS managed functions and accounts via Id Middle. Proceed rigorously to this remaining step and guarantee you have got learn and understood the documentation.
After I’ve created and configured my CMK, I can choose it beneath Superior configuration when enabling Id Middle.
To configure a CMK on an present Id Middle occasion utilizing the AWS Administration Console, I begin by navigating to the Id Middle part of the AWS Administration Console. From there, I choose Settings from the navigation pane, then I choose the Administration tab, and choose Handle encryption within the Key for encrypting IAM Id Middle information at relaxation part.
At any time, I can choose one other CMK from the identical AWS Account, or change again to an AWS-managed key.
After selecting Save, the important thing change course of takes just a few seconds to finish. All service functionalities proceed uninterrupted throughout the transition. If, for no matter causes, Id Middle cannot entry the brand new key, an error message shall be returned and Id Middle will proceed to make use of the present key, retaining your identification information encrypted with the mechanism it’s already encrypted with.
Issues to remember
The encryption key you create turns into a vital part of your Id Middle. While you select to make use of your personal managed key to encrypt identification attributes at relaxation, you need to confirm the next factors.
- Have you ever configured the mandatory permissions to make use of the KMS key? With out correct permissions, enabling the CMK could fail or disrupt IAM Id Middle administration and AWS managed functions.
- Have you ever verified that your AWS managed functions are suitable with CMK keys? For an inventory of suitable functions, see AWS managed functions that you need to use with IAM Id Middle. Enabling CMK for Id Middle that’s utilized by AWS managed functions incompatible with CMK will lead to operational disruption for these functions. If in case you have incompatible functions, don’t proceed.
- Is your group utilizing AWS managed functions that require extra IAM position configuration to make use of the Id Middle and Id Retailer APIs? For every such AWS managed utility that’s already deployed, examine the managed utility’s Person Information for up to date KMS key permissions for IAM Id Centre utilization and replace them as instructed to stop utility disruption.
- For brevity, the KMS key coverage statements on this put up omit the encryption context, which permits you to limit using the KMS key to Id Middle together with a selected occasion. To your manufacturing situations, you possibly can add a situation like this for Id Middle:
"Situation": { "StringLike": { "kms:EncryptionContext:aws:sso:instance-arn": "${identity_center_arn}", "kms:ViaService": "sso.*.amazonaws.com" } }or this for Id Retailer:
"Situation": { "StringLike": { "kms:EncryptionContext:aws:identitystore:identitystore-arn": "${identity_store_arn}", "kms:ViaService": "identitystore.*.amazonaws.com" } }
Pricing and availability
Commonplace AWS KMS prices apply for key storage and API utilization. Id Middle stays accessible at no extra price.
This functionality is now accessible in all AWS industrial Areas, AWS GovCloud (US), and AWS China Areas. To study extra, go to the IAM Id Middle Person Information.
We stay up for studying how you employ this new functionality to satisfy your safety and compliance necessities.