View a markdown version of this page

数据保留服务的自定义 KMS 密钥设置 - AWS Wickr
自定义 KMS 密钥策略设置

本指南记录了 2025 年 3 月 13 日发布的全新 AWS Wickr 管理控制台。有关经典版 AWS Wickr 管理控制台的文档，请参阅经典管理指南。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

数据保留服务的自定义 KMS 密钥设置

要将自己的 KMS 密钥用于数据保留服务，请在启动产品之前使用以下配置创建密钥：

保留密钥

  • 密钥类型：对称 () SYMMETRIC_DEFAULT

  • 密钥用法：加密和解密

  • 密钥轮换：建议启用

密码恢复密钥

  • 密钥类型：非对称 () ECC_NIST_P384

  • 密钥用法：密钥协议

  • 密钥轮换：不支持非对称密钥

自定义 KMS 密钥策略设置

  1. 使用上述所需配置创建 KMS 密钥。

  2. 从 KMS 控制台复制每个密钥的密钥 ID。

  3. 在 Service Catalog 中启动数据保留产品，在KmsKeyId和PasswordRecoveryKeyId字段中输入密钥 ID。

  4. 堆栈完成后，导航至 “输出” 选项卡。

  5. 复制DRSCustomerCrossAccountRoleArn和的值DecryptionLambdaRoleArn。

  6. 打开 KMS 控制台并选择您的自定义保留密钥。

  7. 在 Key Policy (密钥策略) 部分中，选择 Switch to policy view (切换到策略视图)。

  8. 选择编辑。

  9. 将以下语句添加到密钥策略的"Statement"数组中，将占位符 ARN 替换为步骤 5 中的值。

  10. 选择保存更改。

  11. 使用下面的密码恢复语句对密码恢复密钥重复步骤 6—10。

保留密钥-要添加的语句

{
  "Sid": "EnclaveGenerateDataKey",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": "kms:GenerateDataKey",
  "Resource": "*",
  "Condition": {
    "StringLike": {
      "kms:RecipientAttestation:PCR0": "*",
      "kms:RecipientAttestation:PCR1": "*",
      "kms:RecipientAttestation:PCR2": "*"
    },
    "ForAnyValue:StringEquals": {
      "kms:EncryptionContextKeys": [
        "aws:wickr:network:id",
        "aws:wickr:app:id"
      ]
    }
  }
},
{
  "Sid": "EnclaveDescribeKey",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": "kms:DescribeKey",
  "Resource": "*"
},
{
  "Sid": "EnclaveDecryptWithAttestation",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": "kms:Decrypt",
  "Resource": "*",
  "Condition": {
    "StringLike": {
      "kms:RecipientAttestation:PCR0": "*",
      "kms:RecipientAttestation:PCR1": "*",
      "kms:RecipientAttestation:PCR2": "*"
    },
    "ForAnyValue:StringEquals": {
      "kms:EncryptionContextKeys": "aws:wickr:app:id"
    }
  }
},
{
  "Sid": "DecryptLambdaDecrypt",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DecryptionLambdaRoleArn}"
  },
  "Action": "kms:Decrypt",
  "Resource": "*",
  "Condition": {
    "ForAnyValue:StringEquals": {
      "kms:EncryptionContextKeys": "aws:wickr:network:id"
    }
  }
}

每静态加密项声明的目的可在配置使用客户托管 KMS 密钥的权限部分中找到。

密码恢复密钥-要添加的语句

{
  "Sid": "EnclaveDeriveSharedSecret",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": "kms:DeriveSharedSecret",
  "Resource": "*",
  "Condition": {
    "StringLike": {
      "kms:RecipientAttestation:PCR0": "*",
      "kms:RecipientAttestation:PCR1": "*",
      "kms:RecipientAttestation:PCR2": "*"
    }
  }
},
{
  "Sid": "CustomerGetPublicKey",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": [
    "kms:DescribeKey",
    "kms:GetPublicKey"
  ],
  "Resource": "*"
}

每份陈述的目的：

EnclaveDeriveSharedSecret

  • kms: DeriveSharedSecret — 由 Nitro Enclave 调用，使用密码恢复密钥的私钥执行 ECDH 密钥协议。这会派生一个共享密钥，用于在迁移工作流程中解密您的密码。只有当飞地提供有效的 Nitro Enclave 认证文件（PCR0/1/2 条件）时才允许，确保密钥协议不会在飞地之外发生。

CustomerGetPublicKey

  • kms: GetPublicKey — 允许检索密码恢复密钥的 ECC P-384 公钥。客户计算机上运行的密码收集脚本使用它来对密码执行本地 ECDH 加密。

  • kms: DescribeKey — 允许检索密钥元数据（密钥规范、使用情况、状态）以进行验证。

示例-保留密钥

之前：

{
  "Version": "2012-10-17", 
  "Statement": [
    {
      "Sid": "YourExistingStatements",
      "Effect": "...",
      "...": "..."
    }
  ]
}

之后：

{
  "Version": "2012-10-17", 
  "Statement": [
    {
      "Sid": "YourExistingStatements",
      "Effect": "...",
      "...": "..."
     },
    {
      "Sid": "EnclaveGenerateDataKey",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{account-id}:role/DRSCustomerCrossAccountRole-{network-id}-{region}"
      },
      "Action": "kms:GenerateDataKey",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "kms:RecipientAttestation:PCR0": "*",
          "kms:RecipientAttestation:PCR1": "*",
          "kms:RecipientAttestation:PCR2": "*"
        },
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": [
            "aws:wickr:network:id",
            "aws:wickr:app:id"
          ]
        }
      }
    },
    {
      "Sid": "EnclaveDescribeKey",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{account-id}:role/DRSCustomerCrossAccountRole-{network-id}-{region}"
      },
      "Action": "kms:DescribeKey",
      "Resource": "*"
    },
    {
      "Sid": "EnclaveDecryptWithAttestation",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{account-id}:role/DRSCustomerCrossAccountRole-{network-id}-{region}"
      },
      "Action": "kms:Decrypt",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "kms:RecipientAttestation:PCR0": "*",
          "kms:RecipientAttestation:PCR1": "*",
          "kms:RecipientAttestation:PCR2": "*"
        },
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:wickr:app:id"
        }
      }
    },
    {
      "Sid": "DecryptLambdaDecrypt",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{account-id}:role/{DecryptionLambdaRoleName}"
      },
      "Action": "kms:Decrypt",
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:wickr:network:id"
        }
      }
    }
  ]
}