01 Sign in to your Cloud Conformity console, access Database Tier Customer Master Key In Use rule settings and copy the tags defined for your AWS database-tier resources.
02 Create a new access policy that enables the specified AWS IAM users and/or roles to administer the new CMK and the selected IAM users and/or roles to encrypt/decrypt data using the KMS API. Create a new policy document named database-tier-cmk-policy.json and paste the following data (replace the highlighted details, i.e. the ARNs for the IAM users and/or roles, with your own details):
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
{
"Id": "kms-cmk-access-policy",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::<AWS_ACCOUNT_ID>:root"
]
},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Allow access for Key Administrators",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::<AWS_ACCOUNT_ID>:role/<ROLE_NAME>"
]
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow use of the key",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::<AWS_ACCOUNT_ID>:user/<USER_NAME>"
]
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "Allow attachment of persistent resources",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::<AWS_ACCOUNT_ID>:user/<USER_NAME>"
]
},
"Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
}
}
}
]
}
03 Run create-key command (OSX/Linux/UNIX) using the AWS region where the database-tier resources have been provisioned (for example us-east-1) and the policy document defined at the previous step (i.e. database-tier-cmk-policy.json) to create the AWS KMS Customer Master Key (CMK) that will help you encrypt data within the selected AWS database tier:
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
aws kms create-key
--region us-east-1
--description 'KMS CMK to encrypt database tier data'
--policy file://database-tier-cmk-policy.json
04 The command output should return the new CMK metadata:
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
{
"KeyMetadata": {
"Origin": "AWS_KMS",
"KeyId": "1234abcd-cccc-dddd-eeee-123456789012",
"Description": "KMS CMK to encrypt database tier data",
"KeyManager": "CUSTOMER",
"Enabled": true,
"KeyUsage": "ENCRYPT_DECRYPT",
"KeyState": "Enabled",
"CreationDate": 1519843062.520,
"Arn": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-cccc-dddd-eeee-123456789012",
"AWSAccountId": "123456789012"
}
}
05 Run create-alias command (OSX/Linux/UNIX) using the ARN of the newly created key to attach an alias (display name) to the KMS Customer Master Key. The alias must always start with the prefix, i.e. "alias/" (the command does not produce an output):
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
aws kms create-alias
--alias-name alias/database-tier-cmk
--target-key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd-cccc-dddd-eeee-123456789012
06 Run tag-resource command (OSX/Linux/UNIX) using the ID of the newly created AWS KMS CMK as identifier to create tags for managing the identity of the new key (i.e. database-tier encryption key). Use the following format when you define your own tag set: <data_tier_tag>:<data_tier_tag_value> and make sure the tag name and value match the tag set used to organize your database-tier resources. Replace <data_tier_tag> and <data_tier_tag_value> (highlighted) with your own values (the command does not produce an output):
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
aws kms tag-resource
--region us-east-1
--key-id 1234abcd-cccc-dddd-eeee-123456789012
--tags TagKey="<data_tier_tag>",TagValue="<data_tier_tag_value>"
07 Repeat steps no. 1 – 6 to create new dedicated AWS KMS Customer Master Keys to be used by other database-tier resources provisioned in your AWS account.
Security