Encryption at rest with customer managed keys

Next generation Resilience Hub provides encryption by default to protect sensitive customer data at rest using AWS owned keys.

While you cannot disable this layer of encryption or select an alternate encryption type, you can add a second layer of encryption by specifying a customer managed key when you create a service resource:

The following table summarizes how Next generation Resilience Hub encrypts sensitive data.

How Next generation Resilience Hub uses grants in AWS KMS

Next generation Resilience Hub requires a grant to use your customer managed key during asynchronous assessment workflows.

When you create a service with a customer managed key, Next generation Resilience Hub creates a grant on your behalf by sending a CreateGrant request to AWS KMS. The grant is constrained to the encryption context of your service and allows only the following operations:

The grant is retired when you delete the service. You can also revoke access to the grant, or remove the service's access to the customer managed key at any time. If you do, Next generation Resilience Hub cannot access any of the data encrypted by the customer managed key, which affects API operations and assessment workflows that depend on that data.

For synchronous API operations (such as creating or updating a service), Next generation Resilience Hub uses the caller's permissions on the KMS key directly, without requiring a grant.

Create a customer managed key

You can create a symmetric encryption customer managed key by using the AWS Management Console or the AWS KMS APIs.

To create a symmetric encryption customer managed key

Follow the steps for Creating symmetric encryption KMS keys in the AWS Key Management Service Developer Guide.

Specifying a customer managed key for Next generation Resilience Hub

You can specify a customer managed key when you create a service, system, or resiliency policy. When you provide a KMS key ID, Next generation Resilience Hub uses that key to encrypt all sensitive data associated with the resource.

You can specify the key using any of the following key identifiers:

To specify a customer managed key, use the kmsKeyId parameter when calling the CreateService, CreateSystem, or CreatePolicy API operations.

Key policy

Key policies control access to your customer managed key. Every customer managed key must have exactly one key policy, which contains statements that determine who can use the key and how they can use it. When you create your customer managed key, you can specify a key policy. For more information, see Managing access to customer managed keys in the AWS Key Management Service Developer Guide.

The following key policy allows Next generation Resilience Hub to use your key. It scopes each permission to only the operations Next generation Resilience Hub requires, using encryption context conditions to ensure your key can only be used for your specific resources. Replace CUSTOMER-ACCOUNT-ID, CUSTOMER-ROLE, and REGION with your values.

{
    "Version": "2012-10-17", 
    "Statement": [
        {
            "Sid": "AllowResilienceHubDescribeKey",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::CUSTOMER-ACCOUNT-ID:role/CUSTOMER-ROLE"
            },
            "Action": "kms:DescribeKey",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "resiliencehub.REGION.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AllowResilienceHubEncryptDecryptForServices",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::CUSTOMER-ACCOUNT-ID:role/CUSTOMER-ROLE"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "resiliencehub.REGION.amazonaws.com"
                },
                "StringLike": {
                    "kms:EncryptionContext:aws:resiliencehub:service-arn": "arn:aws:resiliencehub:*:CUSTOMER-ACCOUNT-ID:service/*"
                }
            }
        },
        {
            "Sid": "AllowResilienceHubEncryptDecryptForSystems",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::CUSTOMER-ACCOUNT-ID:role/CUSTOMER-ROLE"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "resiliencehub.REGION.amazonaws.com"
                },
                "StringLike": {
                    "kms:EncryptionContext:aws:resiliencehub:system-arn": "arn:aws:resiliencehub:*:CUSTOMER-ACCOUNT-ID:system/*"
                }
            }
        },
        {
            "Sid": "AllowResilienceHubEncryptDecryptForPolicies",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::CUSTOMER-ACCOUNT-ID:role/CUSTOMER-ROLE"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "resiliencehub.REGION.amazonaws.com"
                },
                "StringLike": {
                    "kms:EncryptionContext:aws:resiliencehub:policy-arn": "arn:aws:resiliencehub:*:CUSTOMER-ACCOUNT-ID:policy/*"
                }
            }
        },
        {
            "Sid": "AllowResilienceHubCreateGrantForAsyncWorkflows",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::CUSTOMER-ACCOUNT-ID:role/CUSTOMER-ROLE"
            },
            "Action": "kms:CreateGrant",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "resiliencehub.REGION.amazonaws.com",
                    "kms:GrantConstraintType": "EncryptionContextSubset"
                },
                "StringLike": {
                    "kms:EncryptionContext:aws:resiliencehub:service-arn": "arn:aws:resiliencehub:*:CUSTOMER-ACCOUNT-ID:service/*"
                },
                "ForAllValues:StringEquals": {
                    "kms:GrantOperations": [
                        "Encrypt",
                        "Decrypt",
                        "GenerateDataKey"
                    ]
                }
            }
        }
    ]
}

The policy statements provide the following permissions:

For more information about specifying permissions in a policy, see the AWS Key Management Service Developer Guide.

For more information about troubleshooting key access, see the AWS Key Management Service Developer Guide.

Next generation Resilience Hub encryption context

An encryption context is an optional set of key-value pairs that contain additional contextual information about the data.

AWS KMS uses the encryption context as additional authenticated data to support authenticated encryption. When you include an encryption context in a request to encrypt data, AWS KMS binds the encryption context to the encrypted data. To decrypt data, you must include the same encryption context in the request.

Next generation Resilience Hub encryption context

Next generation Resilience Hub uses the following encryption context keys depending on the resource type:

Example encryption context for a service-level operation:

"encryptionContext": {
    "aws:resiliencehub:service-arn": "arn:aws:resiliencehub:us-west-2:111122223333:service/my-service:abc123"
}

Using encryption context for monitoring

When you use a symmetric encryption customer managed key to encrypt your data, you can use the encryption context in audit records and logs to identify how the customer managed key is being used. The encryption context appears in logs generated by AWS CloudTrail.

Using encryption context to control access

You can use the encryption context in key policies and IAM policies as conditions to control access to your symmetric encryption customer managed key. You can also use encryption context constraints in a grant.

Next generation Resilience Hub uses an encryption context subset constraint in grants to ensure that asynchronous workflows can only encrypt and decrypt data belonging to the specific service the grant was created for.

Monitoring your encryption keys for Next generation Resilience Hub

When you use a customer managed key with your Next generation Resilience Hub resources, you can use AWS CloudTrail to track requests that Next generation Resilience Hub sends to AWS KMS.

Learn more

The following resources provide more information about data encryption at rest.