使用不同 AWS 账户拥有的 CMK 在 Auto Scaling 组中使用加密的 EBS 卷
[英]Using Encrypted EBS Volumes in Auto Scaling Groups with CMK owned by a different AWS account
问题描述
我正在尝试使用 AWS 中的 Auto Scaling 组来创建和管理使用加密快照从 AMI 创建的实例，这些实例已由不同 AWS 账户拥有的 CMK 加密。
我不断收到错误“Client.InternalError：启动时出现客户端错误”。 根据https://docs.aws.amazon.com/autoscaling/ec2/userguide/ts-as-instancelaunchfailure.html#ts-as-instancelaunchfailure-12的场景 2，我需要使用作为受让人主体的 Auto Scaling 组服务相关角色。
我尝试按照 AWS 文档和https://forums.aws.amazon.com/thread.jspa?threadID=277523中的指南来设置赠款。
但是，我不断收到 AccessDeniedException，说我的用户无权在 CMK 上执行 kms:CreateGrant。
我觉得我已经完全按照说明进行操作，但它不起作用。 我希望有人能够提供一些见解。
2 个解决方案
解决方案1
4 已采纳 2019-04-26 03:00:46
我与遇到同样问题的 AWS 员工聊天，直到他重新阅读论坛帖子。 案例 2 第 4 步中的关键行是“不包含 kms:GrantIsForAWSResource 条件以允许账户 111122223333 中的 IAM 用户或角色在下一步中创建授权。”。
换句话说，您需要从客户管理的 CMK 的默认密钥策略中删除此条件。
这些说明本可以使该要求更加明确，但从技术上讲，它已经存在并且可以解决问题。
编辑：为了澄清，我将在下面包含默认和修改后的 JSON。
以下是默认密钥策略，如https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default所示
{
"Version": "2012-10-17",
"Id": "key-consolepolicy-2",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam::111122223333:root"},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Allow access for Key Administrators",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::111122223333:user/KMSAdminUser",
"arn:aws:iam::111122223333:role/KMSAdminRole"
]},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow use of the key",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::111122223333:user/KMSUser",
"arn:aws:iam::111122223333:role/KMSRole",
"arn:aws:iam::444455556666:root"
]},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "Allow attachment of persistent resources",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::111122223333:user/KMSUser",
"arn:aws:iam::111122223333:role/KMSRole",
"arn:aws:iam::444455556666:root"
]},
"Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": "*",
"Condition": {"Bool": {"kms:GrantIsForAWSResource": "true"}}
}
]
}
关键是删除“kms:GrantIsForAWSResource”的条件，如下所示。
{
"Version": "2012-10-17",
"Id": "key-consolepolicy-2",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam::111122223333:root"},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Allow access for Key Administrators",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::111122223333:user/KMSAdminUser",
"arn:aws:iam::111122223333:role/KMSAdminRole"
]},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow use of the key",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::111122223333:user/KMSUser",
"arn:aws:iam::111122223333:role/KMSRole",
"arn:aws:iam::444455556666:root"
]},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "Allow attachment of persistent resources",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::111122223333:user/KMSUser",
"arn:aws:iam::111122223333:role/KMSRole",
"arn:aws:iam::444455556666:root"
]},
"Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": "*"
}
]
}
解决方案2
3 2019-06-07 20:06:02
在阅读了您的有用信息后，我能够解决它，因此我决定也将我的发现发布给其他人。
这正是我为允许“SharedAccountId”访问和使用来自“dev”帐户的自定义 KMS 密钥 (CMK) 所做的。
对于此示例，假设“dev”帐户位于 us-west-2 中，而“SharedAccount”位于 us-east-1 中。
Cloudformation 创建密钥：
注意：在“Dev”帐户中启动此 cloudformation 堆栈，在此示例中位于 us-west-2
{
"Description": "Creates a KMS key used to encrypt snapshots and allows sharing with another account.",
"Outputs": {
"AMIKeyIdOutput": {
"Description": "The KMS Key id used to encrypted snapshots.",
"Export": {
"Name": {
"Fn::Sub": "${AWS::StackName}-kmskeyid"
}
},
"Value": {
"Ref": "AMIKmsKey"
}
},
"AMIKmsAliasOutput": {
"Description": "The KMS key alias used to encrypted snapshots.",
"Export": {
"Name": {
"Fn::Sub": "${AWS::StackName}-kmsalias"
}
},
"Value": {
"Ref": "AMIKmsAlias"
}
}
},
"Parameters": {
"SharedAccountId": {
"AllowedPattern": "^(?!\\s*$).+",
"ConstraintDescription": "You must supply a account id you want to share with.",
"Description": "The account id you want to share this key with.",
"Type": "String"
}
},
"Resources": {
"AMIKmsAlias": {
"Properties": {
"AliasName": {
"Fn::Sub": "alias/amiencryptionkey"
},
"TargetKeyId": {
"Ref": "AMIKmsKey"
}
},
"Type": "AWS::KMS::Alias"
},
"AMIKmsKey": {
"Properties": {
"Description": "AMI encryption key.",
"EnableKeyRotation": "true",
"Enabled": "true",
"KeyPolicy": {
"Statement": [
{
"Action": [
"kms:*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Sub": "arn:aws:iam::${AWS::AccountId}:root"
}
},
"Resource": [
"*"
],
"Sid": "Allow access for Key Administrators"
},
{
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:DescribeKey",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": [
{
"Fn::Join": [
"",
[
"arn:aws:iam::",
{"Ref":"SharedAccountId"},
":root"
]
]
},
{
"Fn::Join": [
"",
[
"arn:aws:iam::",
{"Ref":"SharedAccountId"},
":role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
]
]
},
{
"Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
}
]
},
"Resource": [
"*"
],
"Sid": "Allow use of the key"
},
{
"Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Effect": "Allow",
"Principal": {
"AWS": [
{
"Fn::Sub": "arn:aws:iam::${AWS::AccountId}:root"
},
{
"Fn::Join": [
":",
[
"arn:aws:iam:",
{"Ref":"SharedAccountId"},
"root"
]
]
},
{
"Fn::Join": [
"",
[
"arn:aws:iam::",
{"Ref":"SharedAccountId"},
":role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
]
]
},
{
"Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
}
]
},
"Resource": [
"*"
],
"Sid": "Allow attachment of persistent resources."
}
],
"Version": "2012-10-17"
}
},
"Type": "AWS::KMS::Key"
}
}
}
同样重要的是要注意一些原则是不需要的，但它应该足以让你开始。 按照上述逻辑设置您的 kms 密钥后，您必须运行以下 cli 命令：
注意：在这个例子中
* us-east-1 中的 SharedAccountId
* KMS 密钥位于 us-west-2 中的“Dev”帐户中
aws kms create-grant \
--region us-east-1 \
--profile SharedAccountProfile \
--key-id arn:aws:kms:us-west-2:<DevAccountId>:key/<KMS_KEY_ID From above CF template> \
--grantee-principal arn:aws:iam::<SharedAccountId>:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling \
--operations "Encrypt" "Decrypt" "ReEncryptFrom" "ReEncryptTo" "GenerateDataKey" "GenerateDataKeyWithoutPlaintext" "DescribeKey" "CreateGrant"
应该这样做。 现在，您可以在账户之间共享加密的 AMI，并允许 Autoscaling Groups 与它们一起启动实例。
如何使用 terraform 中的 map 创建多个不同大小的 ebs 卷？
[英]How can I create several ebs volumes each of a different size using a map in terraform?
有没有办法在 AWS 中使用自动缩放来停止不终止实例？
[英]Is there a way to STOP not TERMINATE instances using auto-scaling in AWS?
使用 CDK 创建步骤 Function 并依赖于不同项目拥有的其他 AWS 资源（如 Lambda）
[英]Using CDK to Create a Step Function With Dependencies on Other AWS Resources (Like a Lambda) Owned By Different Projects
具有混合实例策略的 Auto Scaling 组的 AWS 创建策略
[英]AWS Creation Policy for Auto Scaling Group with Mixed Instances Policy
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.