Skip to content

Commit 8450f8b

Browse files
nicusXnicusX
authored
CMK support (#137)
CMK examples
1 parent d02a436 commit 8450f8b

File tree

8 files changed

+664
-0
lines changed

8 files changed

+664
-0
lines changed

‎infrastructure/CMK/README.md

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
## Customer Managed Key (CMK) support
2+
3+
This folder contains CloudFormation templates to help create the IAM Policies and KMS Keys to enable CMK in an
4+
Amazon Managed Service for Apache Flink application.
5+
6+
**Important**: Setting up CMK following the Principle of Least Privilege requires setting up at least two IAM Users or Roles
7+
and executing a number of steps, [described below](#setting-up-cmk-on-an-application), in order and with different users.
8+
This process cannot be automated using a simple CFN template.
9+
The provided CFN templates help create the required IAM Policies and KMS Key with the correct policy. The full process
10+
requires additional steps which can be done manually, using the AWS CLI/API, the Console, or any automation tool.
11+
12+
13+
For further information, see the service documentation: [Key Management in Amazon Managed Service for Apache Flink](https://docs.aws.amazon.com/managed-flink/latest/java/key-management-flink.html).
14+
15+
### Background
16+
17+
#### Actors
18+
19+
To use CMK following the Principle of Least Privilege implies multiple and separate actors:
20+
21+
1. The KMS **Customer Managed Key** (CMK), which comprises a Key Policy and the actual Key Material used for encryption.
22+
2. A **Key Administrator** IAM Role or User, who creates and manages the CMK.
23+
3. An **Operator** IAM Role or User, who uses the Managed Flink API (`kinesisanalyticsv2`) to control the lifecycle of the application, including configuring it and enabling CMK.
24+
4. The Managed Flink **Application** itself, which has an IAM Service Role attached to control the permissions of the application.
25+
26+
![Actors](images/actors.png)
27+
28+
#### Dependencies between components
29+
30+
Some of these components refer to other components, causing dependencies:
31+
32+
* The *Operator* IAM Policy contains a reference to the *Application* and the *CMK* ARNs.
33+
* The *CMK Key Policy* contains a reference to the *Operator* User or Role, the *Key Administrator* User or Role, and the *Application* ARN.
34+
35+
![Dependencies](images/dependencies.png)
36+
37+
Because of these dependencies, setting up CMK for an application must be done in a precise order, as described in the following section.
38+
39+
40+
### Setting up CMK on an application
41+
42+
1. Create the *Operator's Base IAM Policy* using the [msf-base-operator-iam-policy.yaml](./msf-base-operator-iam-policy.yaml) CFN template.
43+
2. Attach the Base Policy to the Operator's User or Role.
44+
3. If the application doesn't exist yet, use the Operator's credentials to create an application _without_ CMK.
45+
4. Create the *Key Administrator's IAM Policy* using [kms-key-administrator-policy.yaml](./kms-key-administrator-policy.yaml) (see Note 3 below).
46+
5. Attach the Policy to the IAM User/Role you are going to use to manage the CMK key.
47+
6. Use the Key Administrator's credentials to create the CMK, using [msf-kms-key.yaml](./msf-kms-key.yaml). The template will ask you to provide the application name, the Operator's Role/User, and the Key Administrator's Role/User ARNs.
48+
7. Create the *Operator's CMK IAM Policy* using [msf-cmk-operator-iam-policy.yaml](./msf-cmk-operator-iam-policy.yaml).
49+
8. Attach the new policy to the Operator's User/Role without removing the Base policy. The template will ask you to provide the application name and the CMK ID.
50+
9. Use the Operator's credentials to update the application, enabling CMK with the key you created in step 6.
51+
52+
#### ⚠️ Important notes
53+
54+
Note 1: No CFN template is provided for steps 2, 3, 5, 7, and 9. These steps depend on your setup and whether you are using IAM Users or Roles as Operator and Key Administrator. You can use the AWS CLI, the Console, or any automation tool for these steps. Refer to the *Using Customer Managed Key in Amazon Managed Service for Apache Flink* service documentation page for setting CMK on an existing application.
55+
56+
Note 2: The *Operator's Base IAM Policy* defined by [msf-base-operator-iam-policy.yaml](./msf-base-operator-iam-policy.yaml) gives the Operator broad permissions to control any application in the account and attach any service role to the application. You can restrict this policy with further conditions as required.
57+
58+
Note 3: The CFN template [msf-kms-key.yaml](./msf-kms-key.yaml) which creates the CMK must be run using the Key Administrator role/user. This user must have at minimum the permissions defined by the Key Administrator IAM Policy created using the [kms-key-administrator-policy.yaml](./kms-key-administrator-policy.yaml) CFN template. It must also have any permissions required to create the stack, for example to upload the template to S3 if you are creating the stack from the console.
59+
60+
### Testing CMK
61+
62+
Setting up CMK following the Principle of Least Privilege, as described above, makes it difficult to simply test CMK where more lenient security policies can be applied, such as in non-production environments.
63+
If you want to use CMK with a single user having broad permissions acting both as *Operator* and *Key Administrator*, you can apply the following Key Policy when you create the CMK Key.
64+
65+
66+
```JSON
67+
{
68+
"Version": "2012-10-17",
69+
"Id": "key-policy-permissive",
70+
"Statement": [
71+
{
72+
"Sid": "Allow any KMS action to Admin",
73+
"Effect": "Allow",
74+
"Principal": {
75+
"AWS": "arn:aws:iam::<account-id>:role/Admin"
76+
},
77+
"Action": "kms:*",
78+
"Resource": "*"
79+
},
80+
{
81+
"Sid": "Allow any KMS action to Managed Flink",
82+
"Effect": "Allow",
83+
"Principal": {
84+
"Service": [
85+
"kinesisanalytics.amazonaws.com",
86+
"infrastructure.kinesisanalytics.amazonaws.com"
87+
]
88+
},
89+
"Action":[ "kms:DescribeKey", "kms:Decrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:CreateGrant" ],
90+
"Resource": "*"
91+
}
92+
]
93+
}
94+
95+
```
96+
97+
⚠️ This key policy should not be used in production environments or environments containing sensitive data.

‎infrastructure/CMK/images/actors.png

236 KB
Loading

‎infrastructure/CMK/images/dependencies.png

123 KB
Loading

‎infrastructure/CMK/kms-key-administrator-policy.yaml

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: 'IAM Policy for KMS Key Administrator with permissions to create, manage, tag, and rotate KMS keys'
3+
4+
Parameters:
5+
PolicyName:
6+
Type: String
7+
Description: 'Name for the IAM Policy'
8+
Default: 'MsfCmkKeyAdministratorPolicy'
9+
AllowedPattern: '^[a-zA-Z0-9+=,.@_-]+$'
10+
ConstraintDescription: 'Must be a valid IAM policy name'
11+
12+
PolicyDescription:
13+
Type: String
14+
Description: 'Description for the IAM Policy'
15+
Default: 'Policy for KMS Key Administrator to create, manage, tag, and rotate CMK KMS keys'
16+
MaxLength: 1000
17+
18+
Resources:
19+
KMSKeyAdministratorPolicy:
20+
Type: AWS::IAM::ManagedPolicy
21+
Properties:
22+
ManagedPolicyName: !Ref PolicyName
23+
Description: !Ref PolicyDescription
24+
PolicyDocument:
25+
Version: '2012-10-17'
26+
Statement:
27+
- Sid: AllowCreateKMSKey
28+
Effect: Allow
29+
Action:
30+
- 'kms:CreateKey'
31+
Resource: '*'
32+
33+
- Sid: AllowListKeysAndAliases
34+
Effect: Allow
35+
Action:
36+
- 'kms:ListKeys'
37+
- 'kms:ListAliases'
38+
Resource: '*'
39+
40+
- Sid: AllowManageKeysInCurrentRegionAndAccount
41+
Effect: Allow
42+
Action:
43+
- 'kms:DescribeKey'
44+
- 'kms:GetKeyPolicy'
45+
- 'kms:PutKeyPolicy'
46+
- 'kms:ListKeyPolicies'
47+
- 'kms:EnableKey'
48+
- 'kms:DisableKey'
49+
- 'kms:CancelKeyDeletion'
50+
- 'kms:ScheduleKeyDeletion'
51+
- 'kms:UpdateKeyDescription'
52+
Resource: !Sub 'arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*'
53+
54+
- Sid: AllowManageKeyAliasesInCurrentRegionAndAccount
55+
Effect: Allow
56+
Action:
57+
- 'kms:CreateAlias'
58+
- 'kms:DeleteAlias'
59+
- 'kms:UpdateAlias'
60+
Resource:
61+
- !Sub 'arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*'
62+
- !Sub 'arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/*'
63+
64+
- Sid: AllowTagKMSKeysInCurrentRegionAndAccount
65+
Effect: Allow
66+
Action:
67+
- 'kms:TagResource'
68+
- 'kms:UntagResource'
69+
- 'kms:ListResourceTags'
70+
Resource: !Sub 'arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*'
71+
72+
- Sid: AllowRotateKMSKeysInCurrentRegionAndAccount
73+
Effect: Allow
74+
Action:
75+
- 'kms:GetKeyRotationStatus'
76+
- 'kms:RotateKeyOnDemand'
77+
- 'kms:ListKeyRotations'
78+
Resource: !Sub 'arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*'
79+
80+
- Sid: AllowKeyUsageForTestingInCurrentRegionAndAccount
81+
Effect: Allow
82+
Action:
83+
- 'kms:Encrypt'
84+
- 'kms:Decrypt'
85+
- 'kms:ReEncrypt*'
86+
- 'kms:GenerateDataKey*'
87+
- 'kms:CreateGrant'
88+
- 'kms:ListGrants'
89+
- 'kms:RevokeGrant'
90+
Resource: !Sub 'arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*'
91+
Condition:
92+
StringEquals:
93+
'kms:ViaService': !Sub 'kinesisanalytics.${AWS::Region}.amazonaws.com'
94+
95+
Outputs:
96+
PolicyArn:
97+
Description: 'ARN of the created KMS Key Administrator IAM Policy'
98+
Value: !Ref KMSKeyAdministratorPolicy
99+
Export:
100+
Name: !Sub '${AWS::StackName}-PolicyArn'
101+
102+
PolicyName:
103+
Description: 'Name of the created KMS Key Administrator IAM Policy'
104+
Value: !Ref PolicyName
105+
Export:
106+
Name: !Sub '${AWS::StackName}-PolicyName'
107+
108+
AccountId:
109+
Description: 'AWS Account ID where the policy was created'
110+
Value: !Ref 'AWS::AccountId'
111+
Export:
112+
Name: !Sub '${AWS::StackName}-AccountId'
113+
114+
Region:
115+
Description: 'AWS Region where the policy was created'
116+
Value: !Ref 'AWS::Region'
117+
Export:
118+
Name: !Sub '${AWS::StackName}-Region'
119+
120+
Metadata:
121+
AWS::CloudFormation::Interface:
122+
ParameterGroups:
123+
- Label:
124+
default: "IAM Policy Configuration"
125+
Parameters:
126+
- PolicyName
127+
- PolicyDescription
128+
ParameterLabels:
129+
PolicyName:
130+
default: "IAM Policy Name"
131+
PolicyDescription:
132+
default: "Policy Description"

‎infrastructure/CMK/msf-base-operator-iam-policy.yaml

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: 'Base IAM Policy for Managed Service for Apache Flink Operator with core MSF permissions'
3+
4+
Parameters:
5+
PolicyName:
6+
Type: String
7+
Description: 'Name for the IAM Policy'
8+
Default: 'MsfBaseApplicationOperator'
9+
AllowedPattern: '^[a-zA-Z0-9+=,.@_-]+$'
10+
ConstraintDescription: 'Must be a valid IAM policy name'
11+
12+
PolicyDescription:
13+
Type: String
14+
Description: 'Description for the IAM Policy'
15+
Default: 'Base IAM policy for Managed Flink Application Operator allowing application lifecycle operations'
16+
MaxLength: 1000
17+
18+
Resources:
19+
MSFBaseOperatorPolicy:
20+
Type: AWS::IAM::ManagedPolicy
21+
Properties:
22+
ManagedPolicyName: !Ref PolicyName
23+
Description: !Ref PolicyDescription
24+
PolicyDocument:
25+
Version: '2012-10-17'
26+
Statement:
27+
- Sid: AllowMsfApiCalls
28+
Effect: Allow
29+
Action: 'kinesisanalytics:*'
30+
Resource: '*'
31+
32+
- Sid: AllowPassingServiceExecutionRole
33+
Effect: Allow
34+
Action:
35+
- 'iam:PassRole'
36+
Resource: !Sub 'arn:aws:iam::${AWS::AccountId}:role/*'
37+
38+
Outputs:
39+
PolicyArn:
40+
Description: 'ARN of the created Base MSF Operator IAM Policy'
41+
Value: !Ref MSFBaseOperatorPolicy
42+
Export:
43+
Name: !Sub '${AWS::StackName}-PolicyArn'
44+
45+
PolicyName:
46+
Description: 'Name of the created Base MSF Operator IAM Policy'
47+
Value: !Ref PolicyName
48+
Export:
49+
Name: !Sub '${AWS::StackName}-PolicyName'
50+
51+
AccountId:
52+
Description: 'AWS Account ID where the policy was created'
53+
Value: !Ref 'AWS::AccountId'
54+
Export:
55+
Name: !Sub '${AWS::StackName}-AccountId'
56+
57+
Region:
58+
Description: 'AWS Region where the policy was created'
59+
Value: !Ref 'AWS::Region'
60+
Export:
61+
Name: !Sub '${AWS::StackName}-Region'
62+
63+
Metadata:
64+
AWS::CloudFormation::Interface:
65+
ParameterGroups:
66+
- Label:
67+
default: "IAM Policy Configuration"
68+
Parameters:
69+
- PolicyName
70+
- PolicyDescription
71+
ParameterLabels:
72+
PolicyName:
73+
default: "IAM Policy Name"
74+
PolicyDescription:
75+
default: "Policy Description"

0 commit comments

Comments
 (0)