|
Beginning right now, you need to use your individual AWS Key Administration Service (AWS KMS) keys to encrypt identification information, akin to person and group attributes, saved in AWS IAM Id Middle group cases.
Many organizations working in regulated industries want full management over encryption key administration. Whereas Id Middle already encrypts information at relaxation utilizing AWS-owned keys, some clients require the flexibility to handle their very own encryption keys for audit and compliance functions.
With this launch, now you can use customer-managed KMS keys (CMKs) to encrypt Id Middle identification information at relaxation. CMKs give you full management over the important thing lifecycle, together with creation, rotation, and deletion. You’ll be able to configure granular entry controls to keys with AWS Key Administration Service (AWS KMS) key insurance policies and IAM insurance policies, serving to to make sure that solely licensed principals can entry your encrypted information. At launch time, the CMK should reside in the identical AWS account and Area as your IAM Id Middle occasion. The combination between Id Middle and KMS offers detailed AWS CloudTrail logs for auditing key utilization and helps meet regulatory compliance necessities.
Id Middle helps each single-Area and multi-Area keys to match your deployment wants. Whereas Id Middle cases can at the moment solely be deployed in a single Area, we advocate utilizing multi-Area AWS KMS keys until your organization insurance policies prohibit you to single-Area keys. Multi-Area keys present constant key materials throughout Areas whereas sustaining impartial key infrastructure in every Area. This provides you extra flexibility in your encryption technique and helps future-proof your deployment.
Let’s get began
Let’s think about I wish to use a CMK to encrypt the identification information of my Id Middle group occasion. My group makes use of Id Middle to offer workers entry to AWS managed functions, akin to Amazon Q Enterprise or Amazon Athena.
As of right now, some AWS managed functions can’t be used with Id Middle configured with a buyer managed KMS key. See AWS managed functions that you need to use with Id Middle to maintain you up to date with the ever evolving listing of suitable functions.
The high-level course of requires first to create a symmetric buyer managed key (CMK) in AWS KMS. The important thing should be configured for encrypt and decrypt operations. Subsequent, I configure the important thing insurance policies to grant entry to Id Middle, AWS managed functions, directors, and different principals who want entry the Id Middle and IAM Id Middle service APIs. Relying in your utilization of Id Middle, you’ll need to outline completely different insurance policies for the important thing and IAM insurance policies for IAM principals. The service documentation has extra particulars that can assist you cowl the commonest use circumstances.
This demo is in three elements. I first create a buyer managed key in AWS KMS and configure it with permissions that can authorize Id Middle and AWS managed functions to make use of it. Second, I replace the IAM insurance policies for the principals that can use the important thing from one other AWS account, akin to AWS functions directors. Lastly, I configure Id Middle to make use of the important thing.
Half 1: Create the important thing and outline permissions
First, let’s create a brand new CMK in AWS KMS.
The important thing should be in the identical AWS Area and AWS account because the Id Middle occasion. You need to create the Id Middle occasion and the important thing within the administration account of your group inside AWS Group.
I navigate to the AWS Key Administration Service (AWS KMS) console in the identical Area as my Id Middle occasion, then I select Create a key. This launches me into the important thing creation wizard.
Below Step 1–Configure key, I choose the important thing kind–both Symmetric (a single key used for each encryption and decryption) or Uneven (a public-private key pair for encryption/decryption and signing/verification). Id Middle requires symmetric keys for encryption at relaxation. I choose Symmetric.
For key utilization, I choose Encrypt and decrypt which permits the important thing for use just for encrypting and decrypting information.
Below Superior choices, I choose KMS – beneficial for Key materials origin, so AWS KMS creates and manages the important thing materials.
For Regionality, I select between Single-Area or Multi-Area key. I choose Multi-Area key to permit key directors to copy the important thing to different Areas. As defined already, Id Middle doesn’t require this right now but it surely helps to future-proof your configuration. Keep in mind which you can not remodel a single-Area key to a multi-Area one after its creation (however you possibly can change the important thing utilized by Id Middle).
Then, I select Subsequent to proceed with further configuration steps, akin to including labels, defining administrative permissions, setting utilization permissions, and reviewing the ultimate configuration earlier than creating the important thing.
Below Step 2–Add Labels, I enter an Alias title for my key and choose Subsequent.
On this demo, I’m modifying the important thing coverage by including coverage statements utilizing templates supplied within the documentation. I skip Step 3 and Step 4 and navigate to Step 5–Edit key coverage.
Id Middle requires, on the minimal, permissions permitting Id Middle and its directors to make use of the important thing. Subsequently, I add three coverage statements, the primary and second authorize the directors of the service, the third one to authorize the Id Middle service itself.
{
"Model": "2012-10-17",
"Id": "key-consolepolicy-3",
"Assertion": [
{
"Sid": "Allow_IAMIdentityCenter_Admin_to_use_the_KMS_key_via_IdentityCenter_and_IdentityStore",
"Effect": "Allow",
"Principal": {
"AWS": "ARN_OF_YOUR_IDENTITY_CENTER_ADMIN_IAM_ROLE"
},
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Useful resource": "*",
"Situation": {
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com",
"identitystore.*.amazonaws.com"
]
}
}
},
{
"Sid": "Allow_IdentityCenter_admin_to_describe_the_KMS_key",
"Impact": "Permit",
"Principal": {
"AWS": "ARN_OF_YOUR_IDENTITY_CENTER_ADMIN_IAM_ROLE"
},
"Motion": "kms:DescribeKey",
"Useful resource": "*"
},
{
"Sid": "Allow_IdentityCenter_and_IdentityStore_to_use_the_KMS_key",
"Impact": "Permit",
"Principal": {
"Service": [
"sso.amazonaws.com",
"identitystore.amazonaws.com"
]
},
"Motion": [
"kms:Decrypt",
"kms:ReEncryptTo",
"kms:ReEncryptFrom",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Useful resource": "*",
"Situation": {
"StringEquals": {
"aws:SourceAccount": ""
}
}
},
{
"Sid": "Allow_IdentityCenter_and_IdentityStore_to_describe_the_KMS_key",
"Impact": "Permit",
"Principal": {
"Service": [
"sso.amazonaws.com",
"identitystore.amazonaws.com"
]
},
"Motion": [
"kms:DescribeKey"
],
"Useful resource": "*"
}
]
} I even have so as to add further coverage statements to permit my use case: using AWS managed functions. I add these two coverage statements to authorize AWS managed functions and their directors to make use of the KMS key. The doc lists further use circumstances and their respective insurance policies.
{
"Sid": "Allow_AWS_app_admins_in_the_same_AWS_organization_to_use_the_KMS_key",
"Impact": "Permit",
"Principal": "*",
"Motion": [
"kms:Decrypt"
],
"Useful resource": "*",
"Situation": {
"StringEquals" : {
"aws:PrincipalOrgID": "MY_ORG_ID (format: o-xxxxxxxx)"
},
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com", "identitystore.*.amazonaws.com"
]
}
}
},
{
"Sid": "Allow_managed_apps_to_use_the_KMS_Key",
"Impact": "Permit",
"Principal": "*",
"Motion": [
"kms:Decrypt"
],
"Useful resource": "*",
"Situation": {
"Bool": { "aws:PrincipalIsAWSService": "true" },
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com", "identitystore.*.amazonaws.com"
]
},
"StringEquals": { "aws:SourceOrgID": "MY_ORG_ID (format: o-xxxxxxxx)" }
}
}You’ll be able to additional prohibit the important thing utilization to a particular Id Middle occasion, particular utility cases, or particular utility directors. The documentation incorporates examples of superior key insurance policies on your use circumstances.
To assist defend in opposition to IAM function title adjustments when permission units are recreated, use the method described within the Customized belief coverage instance.
Half 2: Replace IAM insurance policies to permit use of the KMS key from one other AWS account
Any IAM principal that makes use of the Id Middle service APIs from one other AWS account, akin to Id Middle delegated directors and AWS utility directors, want an IAM coverage assertion that permits use of the KMS key by way of these APIs.
I grant permissions to entry the important thing by creating a brand new coverage and attaching the coverage to the IAM function related for my use case. You can even add these statements to the present identity-based insurance policies of the IAM function.
To take action, after the secret’s created, I find its ARN and substitute the key_ARNwithin the template beneath. Then, I connect the coverage to the managed utility administrator IAM principal. The documentation additionally covers IAM insurance policies that grants Id Middle delegated directors permissions to entry the important thing.
Right here is an instance for managed utility directors:
{
"Sid": "Allow_app_admins_to_use_the_KMS_key_via_IdentityCenter_and_IdentityStore",
"Impact": "Permit",
"Motion":
"kms:Decrypt",
"Useful resource": "",
"Situation": {
"StringLike": {
"kms:ViaService": [
"sso.*.amazonaws.com",
"identitystore.*.amazonaws.com"
]
}
}
} The documentation shares IAM insurance policies template for the commonest use circumstances.
Half 3: Configure IAM Id Middle to make use of the important thing
I can configure a CMK both throughout the enablement of an Id Middle group occasion or on an present occasion, and I can change the encryption configuration at any time by switching between CMKs or reverting to AWS-owned keys.
Please observe that an incorrect configuration of KMS key permissions can disrupt Id Middle operations and entry to AWS managed functions and accounts via Id Middle. Proceed rigorously to this ultimate step and guarantee you could have learn and understood the documentation.
After I’ve created and configured my CMK, I can choose it beneath Superior configuration when enabling Id Middle.
To configure a CMK on an present Id Middle occasion utilizing the AWS Administration Console, I begin by navigating to the Id Middle part of the AWS Administration Console. From there, I choose Settings from the navigation pane, then I choose the Administration tab, and choose Handle encryption within the Key for encrypting IAM Id Middle information at relaxation part.
At any time, I can choose one other CMK from the identical AWS Account, or change again to an AWS-managed key.
After selecting Save, the important thing change course of takes a number of seconds to finish. All service functionalities proceed uninterrupted throughout the transition. If, for no matter causes, Id Middle cannot entry the brand new key, an error message might be returned and Id Middle will proceed to make use of the present key, preserving your identification information encrypted with the mechanism it’s already encrypted with.
Issues to bear in mind
The encryption key you create turns into an important element of your Id Middle. While you select to make use of your individual managed key to encrypt identification attributes at relaxation, it’s important to confirm the next factors.
- Have you ever configured the mandatory permissions to make use of the KMS key? With out correct permissions, enabling the CMK might fail or disrupt IAM Id Middle administration and AWS managed functions.
- Have you ever verified that your AWS managed functions are suitable with CMK keys? For an inventory of suitable functions, see AWS managed functions that you need to use with IAM Id Middle. Enabling CMK for Id Middle that’s utilized by AWS managed functions incompatible with CMK will lead to operational disruption for these functions. When you’ve got incompatible functions, don’t proceed.
- Is your group utilizing AWS managed functions that require further IAM function configuration to make use of the Id Middle and Id Retailer APIs? For every such AWS managed utility that’s already deployed, verify the managed utility’s Person Information for up to date KMS key permissions for IAM Id Centre utilization and replace them as instructed to stop utility disruption.
- For brevity, the KMS key coverage statements on this publish omit the encryption context, which permits you to limit using the KMS key to Id Middle together with a particular occasion. In your manufacturing eventualities, you possibly can add a situation like this for Id Middle:
"Situation": { "StringLike": { "kms:EncryptionContext:aws:sso:instance-arn": "${identity_center_arn}", "kms:ViaService": "sso.*.amazonaws.com" } }or this for Id Retailer:
"Situation": { "StringLike": { "kms:EncryptionContext:aws:identitystore:identitystore-arn": "${identity_store_arn}", "kms:ViaService": "identitystore.*.amazonaws.com" } }
Pricing and availability
Normal AWS KMS expenses apply for key storage and API utilization. Id Middle stays obtainable at no further value.
This functionality is now obtainable in all AWS industrial Areas, AWS GovCloud (US), and AWS China Areas. To be taught extra, go to the IAM Id Middle Person Information.
We sit up for studying how you utilize this new functionality to fulfill your safety and compliance necessities.
