本指南记录了 2025 年 3 月 13 日发布的全新 AWS Wickr 管理控制台。有关经典版 AWS Wickr 管理控制台的文档，请参阅[经典管理指南](https://docs.aws.amazon.com/wickr/latest/adminguide-classic/what-is-wickr.html)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 数据保留服务的自定义 KMS 密钥设置
<a name="custom-kms-key"></a>

要将自己的 KMS 密钥用于数据保留服务，请在启动产品之前使用以下配置创建密钥：

保留密钥  
+ 密钥类型：对称 () `SYMMETRIC_DEFAULT`
+ 密钥用法：加密和解密
+ 密钥轮换：建议启用

密码恢复密钥  
+ 密钥类型：非对称 () `ECC_NIST_P384`
+ 密钥用法：密钥协议
+ 密钥轮换：不支持非对称密钥

## 自定义 KMS 密钥策略设置
<a name="custom-kms-key-policy-setup"></a>

1. 使用上述所需配置创建 KMS 密钥。

1. 从 KMS 控制台复制每个**密钥的密钥 ID**。

1. 在 Service Catalog 中启动数据保留产品，在`KmsKeyId`和`PasswordRecoveryKeyId`字段中输入密钥 ID。

1. 堆栈完成后，导航至 “**输出**” 选项卡。

1. 复制`DRSCustomerCrossAccountRoleArn`和的值`DecryptionLambdaRoleArn`。

1. 打开 KMS 控制台并选择您的自定义保留密钥。

1. 在 **Key Policy (密钥策略)** 部分中，选择 **Switch to policy view (切换到策略视图)**。

1. 选择**编辑**。

1. 将以下语句添加到密钥策略的`"Statement"`数组中，将占位符 ARN 替换为步骤 5 中的值。

1. 选择**保存更改**。

1. 使用下面的密码恢复语句对密码恢复密钥重复步骤 6—10。

### 保留密钥-要添加的语句
<a name="custom-kms-key-retention-statements"></a>

```
{
  "Sid": "EnclaveGenerateDataKey",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": "kms:GenerateDataKey",
  "Resource": "*",
  "Condition": {
    "StringLike": {
      "kms:RecipientAttestation:PCR0": "*",
      "kms:RecipientAttestation:PCR1": "*",
      "kms:RecipientAttestation:PCR2": "*"
    },
    "ForAnyValue:StringEquals": {
      "kms:EncryptionContextKeys": [
        "aws:wickr:network:id",
        "aws:wickr:app:id"
      ]
    }
  }
},
{
  "Sid": "EnclaveDescribeKey",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": "kms:DescribeKey",
  "Resource": "*"
},
{
  "Sid": "EnclaveDecryptWithAttestation",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": "kms:Decrypt",
  "Resource": "*",
  "Condition": {
    "StringLike": {
      "kms:RecipientAttestation:PCR0": "*",
      "kms:RecipientAttestation:PCR1": "*",
      "kms:RecipientAttestation:PCR2": "*"
    },
    "ForAnyValue:StringEquals": {
      "kms:EncryptionContextKeys": "aws:wickr:app:id"
    }
  }
},
{
  "Sid": "DecryptLambdaDecrypt",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DecryptionLambdaRoleArn}"
  },
  "Action": "kms:Decrypt",
  "Resource": "*",
  "Condition": {
    "ForAnyValue:StringEquals": {
      "kms:EncryptionContextKeys": "aws:wickr:network:id"
    }
  }
}
```

每[静态加密](encryption-rest.md)项声明的目的可在**配置使用客户托管 KMS 密钥的权限**部分中找到。

### 密码恢复密钥-要添加的语句
<a name="custom-kms-key-password-recovery-statements"></a>

```
{
  "Sid": "EnclaveDeriveSharedSecret",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": "kms:DeriveSharedSecret",
  "Resource": "*",
  "Condition": {
    "StringLike": {
      "kms:RecipientAttestation:PCR0": "*",
      "kms:RecipientAttestation:PCR1": "*",
      "kms:RecipientAttestation:PCR2": "*"
    }
  }
},
{
  "Sid": "CustomerGetPublicKey",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{DRSCustomerCrossAccountRoleArn}"
  },
  "Action": [
    "kms:DescribeKey",
    "kms:GetPublicKey"
  ],
  "Resource": "*"
}
```

每份陈述的目的：

**EnclaveDeriveSharedSecret**
+ kms: DeriveSharedSecret — 由 Nitro Enclave 调用，使用密码恢复密钥的私钥执行 ECDH 密钥协议。这会派生一个共享密钥，用于在迁移工作流程中解密您的密码。只有当飞地提供有效的 Nitro Enclave 认证文件（PCR0/1/2 条件）时才允许，确保密钥协议不会在飞地之外发生。

**CustomerGetPublicKey**
+ kms: GetPublicKey — 允许检索密码恢复密钥的 ECC P-384 公钥。客户计算机上运行的密码收集脚本使用它来对密码执行本地 ECDH 加密。
+ kms: DescribeKey — 允许检索密钥元数据（密钥规范、使用情况、状态）以进行验证。

### 示例-保留密钥
<a name="custom-kms-key-example"></a>

之前：

```
{
  "Version": "2012-10-17", 		 	 	 
  "Statement": [
    {
      "Sid": "YourExistingStatements",
      "Effect": "...",
      "...": "..."
    }
  ]
}
```

之后：

```
{
  "Version": "2012-10-17", 		 	 	 
  "Statement": [
    {
      "Sid": "YourExistingStatements",
      "Effect": "...",
      "...": "..."
     },
    {
      "Sid": "EnclaveGenerateDataKey",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{account-id}:role/DRSCustomerCrossAccountRole-{network-id}-{region}"
      },
      "Action": "kms:GenerateDataKey",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "kms:RecipientAttestation:PCR0": "*",
          "kms:RecipientAttestation:PCR1": "*",
          "kms:RecipientAttestation:PCR2": "*"
        },
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": [
            "aws:wickr:network:id",
            "aws:wickr:app:id"
          ]
        }
      }
    },
    {
      "Sid": "EnclaveDescribeKey",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{account-id}:role/DRSCustomerCrossAccountRole-{network-id}-{region}"
      },
      "Action": "kms:DescribeKey",
      "Resource": "*"
    },
    {
      "Sid": "EnclaveDecryptWithAttestation",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{account-id}:role/DRSCustomerCrossAccountRole-{network-id}-{region}"
      },
      "Action": "kms:Decrypt",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "kms:RecipientAttestation:PCR0": "*",
          "kms:RecipientAttestation:PCR1": "*",
          "kms:RecipientAttestation:PCR2": "*"
        },
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:wickr:app:id"
        }
      }
    },
    {
      "Sid": "DecryptLambdaDecrypt",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{account-id}:role/{DecryptionLambdaRoleName}"
      },
      "Action": "kms:Decrypt",
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:wickr:network:id"
        }
      }
    }
  ]
}
```