代码之家 › 专栏 › 技术社区 › maafk

AWS IAM策略强制加密新的EBS卷

amazon-ebs amazon-iam amazon-web-services

7

maafk · 技术社区 · 7 年前

在 AWS Key Management Service Best Practices whitepaper ,在关于使用Amazon EBS进行静态数据加密的部分中,它指出:

有两种方法可以确保EBS卷始终加密。您可以验证加密标志是否作为 CreateVolume 通过IAM策略将上下文设置为true。如果标志不是如果为true,则IAM策略可以阻止个人创建 EBS音量

我该怎么做?我可以想象政策会是这样的:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1509465260000",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVolume"
      ],
      "Condition": {
        "Bool": {
          "ec2:Encrypted": "true"
        }
      },
      "Resource": [
        "*"
      ]
    }
  ]
}

基于白皮书和 docs Bool 上的条件 ec2:Encrypted 密钥最有意义,但当试图创建加密卷时,访问被拒绝。

我在声明中遗漏了什么?

3 回复 | 直到 7 年前

1

5

John Hanley 7 年前

您需要额外的权限才能创建加密卷:

1) ec2:描述可用性

2) 公里数:*

注意:我没有深入到KMS以获得使用KMS加密密钥的最低权限。如果要从快照创建卷,则需要添加 ec2:DescribeSnapshots .

政策示例:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeAvailabilityZones"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Stmt1509465260000",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVolume"
            ],
            "Condition": {
                "Bool": {
                    "ec2:Encrypted": "true"
                }
            },
            "Resource": [
                "*"
            ]
        }
    ]
}

2

4

maafk 7 年前

约翰·汉利说得对

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt2222222222222",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVolume"
      ],
      "Condition": {
        "Bool": {
          "ec2:Encrypted": "true"
        }
      },
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "Stmt1111111111111",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVolumes",
        "ec2:DescribeAvailabilityZones",
        "ec2:CreateTags",
        "kms:ListAliases"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "allowKmsKey",
      "Effect": "Allow",
      "Action": [
        "kms:Encrypt"
      ],
      "Resource": [
        "arn:aws:kms:us-east-1:999999999999:alias/aws/ebs"
      ]
    }
  ]
}

3

1

Ajay Singh 4 年前

单独使用“kms:encrypt”无法创建加密的ebs。在以下链接中找到了有效的解决方案

https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html

Permissions for creating and attaching EBS Volume to an EC2Resource i AWS Data Pipeline

要在不执行通配符kms操作(“kms”:*)的情况下使用,请在操作下包括以下内容

"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"

"ec2:CreateVolume",
"ec2:CreateTags",
"ec2:DescribeVolumeAttribute",
"ec2:DescribeVolumeStatus",
"ec2:DescribeVolumes",
"ec2:DescribeAvailabilityZones",
"ec2:EnableVolumeIO"