{"id":128063,"date":"2020-06-07T07:56:32","date_gmt":"2020-06-06T23:56:32","guid":{"rendered":"http:\/\/4563.org\/?p=128063"},"modified":"2020-06-07T07:56:32","modified_gmt":"2020-06-06T23:56:32","slug":"aws-kms-%e7%a7%91%e6%99%ae-what-why-and-how","status":"publish","type":"post","link":"http:\/\/4563.org\/?p=128063","title":{"rendered":"AWS KMS \u79d1\u666e: What Why and How?"},"content":{"rendered":"
\n
\n
\n

AWS KMS \u79d1\u666e: What Why and How? <\/h1>\n

<\/p>\n

\n
\u8cc7\u6df1\u5927\u4f6c : Shikyou <\/span> <\/i> 8<\/span> <\/div>\n
<\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n
<\/p>\n

What: \u5bc6\u94a5\u7ba1\u7406 \u2014\u2014 \u52a0\u5bc6\u5e76\u4e0d\u96be\uff0c\u96be\u7684\u662f\u5bc6\u94a5\u7ba1\u7406<\/h2>\n

AWS KMS \u5168\u79f0\u4e3a Key Management Service\uff0c\u4e2d\u6587\u76f4\u8bd1\u8fc7\u6765\u4e3a\u5bc6\u94a5\u7ba1\u7406\u670d\u52a1 \u2014\u2014 \u8fd9\u4e00\u70b9\u5f88\u91cd\u8981\uff0c\u5b83\u63d0\u4f9b\u7684\u6838\u5fc3\u670d\u52a1\u662f\u5bc6\u94a5\u7ba1\u7406\uff0c\u5e2e\u52a9\u4f01\u4e1a\u3001\u5f00\u53d1\u8005\u65b9\u4fbf\u5b89\u5168\u5730\u7ba1\u7406\u5bc6\u94a5\u3002\u5f88\u591a\u521a\u63a5\u89e6 KMS \u7684\u540c\u5b66\u7ecf\u5e38\u641e\u4e0d\u6e05 KMS \u5230\u5e95\u505a\u662f\u505a\u4ec0\u4e48\u7684\uff0c\u5f88\u5927\u539f\u56e0\u4e5f\u662f\u6ca1\u4ed4\u7ec6\u6ce8\u610f\u5230 Key Management \u8fd9\u4e24\u4e2a\u8bcd\u3002<\/p>\n

\u6240\u4ee5\u6211\u4eec\u7684\u7b2c\u4e00\u4e2a\u95ee\u9898\u300c What \u300d\u5c31\u5df2\u7ecf\u56de\u7b54\u4e86\uff0cKMS \u5c31\u662f\u4e00\u4e2a\u7ba1\u7406\u5bc6\u94a5\u7684\u670d\u52a1\uff0c\u5b83\u5e76\u4e0d\u662f\u67d0\u79cd super super magic \u7684\u9ad8\u8d85\u52a0\u5bc6\u65b9\u6cd5\u3002<\/p>\n

\u6211\u5e0c\u671b\u672c\u6587\u7684\u8bfb\u8005\u901a\u8fc7\u9605\u8bfb\u80fd\u610f\u8bc6\u5230\u4e00\u4e2a\u89c2\u5ff5\uff1a\u52a0\u5bc6\u662f\u7b80\u5355\u7684\uff0c\u96be\u7684\u662f\u7ba1\u7406\u5bc6\u94a5\u672c\u8eab\u3002<\/p>\n

Why: KMS \u80fd\u786e\u4fdd\u4f60\u5bc6\u94a5\u7684\u5b89\u5168\u6027<\/h2>\n

\u63a5\u7740\u6765\u770b\u7b2c\u4e8c\u4e2a\u95ee\u9898\uff1aWhy \uff1f\u4e3a\u4ec0\u4e48\u6211\u9700\u8981\u628a\u6211\u7684\u5bc6\u94a5\u7ed9\u4f60\u7ba1\u7406\uff0c\u6211\u81ea\u5df1\u4fdd\u5b58\u4e0d\u884c\u4e86\u5417\uff1f\u4e8b\u5b9e\u4e0a\u4f60\u5b8c\u5168\u53ef\u4ee5\u81ea\u5df1\u7ba1\u7406\uff0c\u5c31\u50cf\u4f60\u5b8c\u5168\u53ef\u4ee5\u81ea\u5efa\u673a\u623f\u4e00\u6837\uff0conly if \u4f60\u6e05\u695a\u5404\u79cd\u6700\u4f73\u5b9e\u8df5\u5e76\u613f\u610f\u82b1\u65f6\u95f4\u81ea\u5df1\u53bb\u7ef4\u62a4\u3002\u670d\u52a1\u4e4b\u6240\u4ee5\u53eb\u670d\u52a1\uff0c\u662f\u670d\u52a1\u63d0\u4f9b\u5546\u4e3a\u4f60\u505a\u4e86\u5404\u79cd\u5404\u6837\u9ebb\u70e6\u7684\u4e8b\u60c5\uff08 They deal with those heavy lifting \uff09\uff0c\u4ece\u800c\u8ba9\u4f60\u628a\u66f4\u591a\u7684\u65f6\u95f4\u7cbe\u529b\u82b1\u5728\u66f4\u6709\u4ef7\u503c\u7684\u4e8b\u60c5\u4e0a\u3002<\/p>\n

\u90a3\u4e48 AWS KMS \u4e3a\u7528\u6237\u505a\u4e86\u54ea\u4e9b\u9ebb\u70e6\u7684\u5de5\u4f5c\u5462\uff1f<\/p>\n

    \n
  1. \u5b8c\u5168\u6258\u7ba1\uff1a\u4f60\u4e0d\u9700\u8981\u989d\u5916\u7684\u670d\u52a1\u5668\uff0c\u4e0d\u9700\u8981\u989d\u5916\u7684\u7ef4\u62a4\u4eba\u5458\u3002<\/li>\n
  2. \u7b80\u5316\u52a0\u5bc6\u8fc7\u7a0b\uff1a\u4f60\u4e0d\u9700\u8981\u53bb\u5728\u610f\u7e41\u7410\u7684\u52a0\u5bc6\u7ec6\u8282\u8fc7\u7a0b\uff0c\u53ea\u9700\u8981\u8c03\u7528\u76f8\u5173\u63a5\u53e3\u5c31\u884c\u4e86\u3002<\/li>\n
  3. \u5b89\u5168\u5ba1\u8ba1\u529f\u80fd\uff1a\u5173\u80fd\u591f\u786e\u4fdd\u5b89\u5168\u662f\u4e0d\u591f\u7684\uff0c\u4f60\u8fd8\u9700\u8981\u77e5\u9053\u8c01\u5177\u5907\u8fd9\u4e2a\u5bc6\u94a5\u7684\u4f7f\u7528\u6743\u9650\uff0c\u8c01\u5728\u4ec0\u4e48\u65f6\u5019\u7528\u4e86\u8fd9\u4e2a\u5bc6\u94a5\uff0c\u8c01\u53c8\u5728\u4ec0\u4e48\u65f6\u5019\u5220\u4e86\u8fd9\u4e2a\u5bc6\u94a5\u3002\u8fd9\u4e00\u70b9\u5bf9\u5927\u578b\u4f01\u4e1a\u4ee5\u53ca\u63d0\u4f9b\u5e73\u53f0\u670d\u52a1\u7684\u516c\u53f8\u975e\u5e38\u91cd\u8981\u3002\u800c\u8fd9\u4e9b\u80fd\u591f\u7cbe\u786e\u5230\u975e\u5e38\u7ec6\u9897\u7c92\u5ea6\u7684\u5ba1\u8ba1\u529f\u80fd\uff0c\u5df2\u7ecf\u88ab AWS \u901a\u8fc7 AWS Cloud Trail Service \u5b8c\u5168\u5185\u7f6e\u5728\u6574\u4e2a AWS \u751f\u6001\u5185\u4e86\u3002\uff08 It’s not enough to be secure, you have to demonstrate to somebody, whether that’s internal audit, your boss, or maybe your customers . \uff09<\/li>\n
  4. \u786e\u4fdd\u4f60\u7684\u5bc6\u94a5\u662f\u5b89\u5168\u7684\uff1a\u4f60\u4e0d\u9700\u8981\u8d39\u52b2\u8111\u6c41\u60f3\u529e\u6cd5\u628a\u4f60\u7684\u5bc6\u94a5\u4fdd\u5b58\u5728\u67d0\u4e2a\u673a\u5bc6\u7684\u3001\u4e0d\u5bf9\u5916\u7f51\u66b4\u9732\u7684\u5730\u65b9\u3002\u4e8b\u5b9e\u4e0a AWS KMS \u7684\u5bc6\u94a5\uff08\u786e\u5207\u6765\u8bf4\u662f Matser Key \uff09\u662f\u5b8c\u5168\u4fdd\u5b58\u5728\u5185\u5b58\u4e2d\u7684\uff0c\u6ca1\u6709\u4efb\u4f55\u4eba\uff08\u5305\u62ec AWS \u81ea\u5df1\uff09\u80fd\u591f\u83b7\u53d6\u5230\u5bc6\u94a5\u7684\u539f\u59cb\u5185\u5bb9\uff0c\u4e0b\u6587\u4f1a\u4ecb\u7ecd\u4e3a\u4ec0\u4e48\u3002<\/li>\n
  5. \u5bc6\u94a5 rotate \u6d41\u7a0b\uff1aAWS \u4f1a\u5b9a\u65f6\u6216\u624b\u52a8\u5237\u65b0\u5bc6\u94a5\u5185\u5bb9\uff0c\u8fd9\u4e5f\u662f\u5bc6\u94a5\u7ba1\u7406\u7684\u4e00\u4e2a\u6700\u4f73\u5b9e\u8df5\u3002<\/li>\n<\/ol>\n

    How: It’s complicated but they do it for you<\/h2>\n

    \u77e5\u9053\u4e86\u4e3a\u4ec0\u4e48\u4f7f\u7528 AWS KMS\uff0c\u63a5\u4e0b\u6765\u4e5f\u662f\u672c\u6587\u91cd\u70b9\u5185\u5bb9\uff0c\u4e86\u89e3\u4e00\u4e0b How: KMS \u5185\u90e8\u5b9e\u73b0\u539f\u7406\u3002<\/p>\n

    \u9996\u5148\u4e86\u89e3\u4e00\u4e0b\u5bf9\u79f0\u52a0\u5bc6\u4e0e\u975e\u5bf9\u79f0\u52a0\u5bc6\uff1a\u7b80\u8981\u6765\u8bf4\uff0c\u5bf9\u79f0\u52a0\u5bc6\u6307\u7684\u662f\u52a0\u5bc6\u3001\u89e3\u5bc6\u7528\u7684\u662f\u540c\u4e00\u4e2a\u5bc6\u94a5\uff1b\u975e\u5bf9\u79f0\u52a0\u5bc6\u6307\u7684\u662f\u52a0\u5bc6\u3001\u89e3\u5bc6\u4f7f\u7528\u4e00\u5bf9\u5bc6\u94a5\uff1a\u516c\u94a5\u548c\u79c1\u94a5\uff0c\u4f60\u53ef\u4ee5\u4f7f\u7528\u516c\u94a5\u52a0\u5bc6\u79c1\u94a5\u89e3\u5bc6\uff0c\u4e5f\u53ef\u4ee5\u53cd\u8fc7\u6765\u3002\u5982 HTTPS \u7528\u7684\u5c31\u662f\u975e\u5bf9\u79f0\u52a0\u5bc6\u3002<\/p>\n

    \u63a5\u4e0b\u6765\u770b\u770b KMS \u5185\u90e8\u662f\u5982\u4f55\u4fdd\u5b58\u4f60\u7684\u5bc6\u94a5\u7684\uff1a\u5047\u8bbe\u6211\u4eec\u6709\u4e00\u4e2a\u7528\u4e8e\u52a0\u5bc6\u6570\u636e\u7684\u5bc6\u94a5\uff0c\u53eb\u505a Data Key\uff0c\u5c06 Data \u52a0\u5bc6\u8fc7\u540e\u5f97\u5230 Encrypted Data\uff0c\u8fd9\u4e2a\u8fc7\u7a0b\u5f88\u7b80\u5355\u3002<\/p>\n

    \u4f46\u662f\u95ee\u9898\u6765\u4e86\uff0c\u8be5\u600e\u4e48\u5904\u7406 Data Key \u5462\uff0c\u8981\u662f\u653b\u51fb\u8005\u83b7\u53d6\u5230\u4e86 Data Key\uff0c\u90a3\u4e0d\u76f8\u5f53\u4e8e\u6570\u636e\u4e5f\u5c31\u88ab\u7834\u89e3\u4e86\uff1f\u6b63\u786e\u7684\u9009\u62e9\u662f\u628a Data Key \u4e5f\u7528\u67d0\u79cd\u5bc6\u94a5\uff08\u8fd9\u91cc\u628a\u5b83\u53eb\u505a Matser Key \uff09\u52a0\u5bc6\u4e00\u4e0b\uff08\u672f\u8bed\u53eb\u505a Wrapping \uff09\uff0c\u5f97\u5230 Encrypted Data Key \u3002\u63a5\u7740\u6211\u4eec\u628a Encrypted Data \u548c Encrypted Data Key \u4fdd\u5b58\u5728\u4e00\u8d77\uff0c\u5982\u4e0b\u56fe\u6240\u793a\uff1a<\/p>\n

    \u53ef\u662f\u95ee\u9898\u53c8\u6765\u4e86\uff1aMaster Key \u600e\u4e48\u52a0\u5bc6\uff1f\u76f8\u4fe1\u4f60\u5df2\u7ecf\u5bdf\u89c9\u51fa\u6765\u4e86\uff0c\u8fd9\u5f88\u50cf\u4e00\u4e2a\u4fc4\u7f57\u65af\u5957\u5a03\uff08\u5212\u6389\uff09<\/p>\n

    \u4f60\u6ca1\u6709\u770b\u9519\uff0cAWS KMS \u8fd8\u771f\u5c31\u662f\u8fd9\u4e48\u505a\u7684\uff0c\u4ed6\u4eec\u8fd9\u6837\u4e00\u5c42\u4e00\u5c42\u52a0\u5bc6\u5bc6\u94a5\uff08\u4e13\u4e1a\u540d\u8bcd\u53eb\u505a KMS Key Hierarchy \uff09\uff0c\u5230\u6700\u7ec8\u7684\u90a3\u4e2a Key \u7684\u65f6\u5019\uff0c\u5b83\u7684\u786e\u662f\u4e00\u4e2a\u660e\u6587\uff0c\u4f46\u662f\uff1a<\/p>\n

      \n
    1. \u5b83\u5b8c\u5b8c\u5168\u5168\u4fdd\u5b58\u5728\u5185\u5b58\u91cc\u9762\uff0c\u6c38\u8fdc\u4e0d\u4f1a\u5728\u7269\u7406\u4ecb\u8d28\u91cc\u9762\u4fdd\u5b58\u4e0b\u6765\u3002<\/li>\n
    2. \u5b83\u6c38\u8fdc\u4e0d\u4f1a\u5728\u516c\u7f51\u4f20\u8f93\u3002<\/li>\n<\/ol>\n

      \u4ee5\u81f3\u4e8e\u8fde AWS \u5458\u5de5\u90fd\u6ca1\u6709\u529e\u6cd5\u83b7\u53d6\u5230\u539f\u59cb\u5185\u5bb9\u3002<\/p>\n

      \u90a3\u4e48\u5176\u4ed6\u7684 Data Key \u5462\uff1f\u6211\u771f\u6b63\u52a0\u5bc6\u7684\u6570\u636e\u7684\u6570\u636e\u7528\u7684\u662f Data Key\uff0c\u8981\u662f Data Key \u6cc4\u6f0f\u4e86\u600e\u4e48\u529e\uff1f\u8fd9\u4e2a\u95ee\u9898\u5f88\u91cd\u8981\u3002\u90a3\u4e48 KMS \u662f\u5982\u4f55\u89e3\u51b3\u7684\u5462\uff1f<\/p>\n

      KMS \u7684 Data Key \u662f\u5728\u5185\u5b58\u4e2d\u52a8\u6001\u751f\u6210\u7684\uff0c\u7528\u4e8e\u52a0\u5bc6\u6570\u636e\u8fc7\u540e\uff0c\u5b83\u5c31\u5728\u5185\u5b58\u4e2d\u88ab\u5220\u6389\u4e86\uff0c\u53ea\u6709\u52a0\u5bc6\u8fc7\u540e\u7684 Encrypted Data Key \u4fdd\u7559\u4e86\u4e0b\u6765\u3002<\/p>\n

      \u501f\u7528 AWS re:Invent 2019 \u4e0a AWS Solution Architect Peter M.O’Donnell \u7684\u8bdd\uff1a KMS is a very serious service, built by very serious people for very serious customers .<\/p>\n

      \u603b\u7ed3\u4e00\u4e0b\uff1a<\/strong><\/p>\n

        \n
      1. Data \u662f\u7528 Data Key \u52a0\u5bc6\u7684\uff0c\u5f97\u5230 Encrypted Data \u3002<\/li>\n
      2. Encrypted Data \u548c Encrypted Data Key \u4fdd\u5b58\u5728\u4e86\u4e00\u8d77\u3002<\/li>\n
      3. \u4f60\u5c31\u7b97\u5f97\u5230\u4e86 Encrypted Data \u548c Encrypted Data Key \u4e5f\u6ca1\u7528\uff0c\u4f60\u8fd8\u5f97\u5f97\u5230\u4e0a\u4e00\u5c42\u52a0\u5bc6\u6b64 Encrypted Data Key \u7684 Matser Key\uff0c\u4e00\u5c42\u4e00\u5c42\u5f80\u4e0a\uff0c\u4f60\u5f97\u77e5\u9053\u6700\u7ec8\u90a3\u4e2a\u5728 Top Level \u7684 Master Key \u3002<\/li>\n
      4. KMS \u5728\u6839\u672c\u4e0a\u901a\u8fc7\u8bbe\u8ba1\uff0c\u786e\u4fdd\u4e86\u6ca1\u6709\u4efb\u4f55\u4eba\u80fd\u591f\u83b7\u53d6\u5230 Top Level Master Key \u3002<\/li>\n
      5. \u6240\u4ee5\u4f60\u7684\u6570\u636e\u662f\u5b89\u5168\u7684\u3002<\/li>\n<\/ol>\n

        \u8fd9\u7bc7\u6587\u7ae0\u4ecb\u7ecd\u4e86 AWS KMS \u662f\u4ec0\u4e48\u3001\u4e3a\u4ec0\u4e48\u8981\u7528 KMS \u4ee5\u53ca KMS \u662f\u5982\u4f55\u4fdd\u62a4\u4f60\u7684\u5bc6\u94a5\u4ece\u800c\u4fdd\u62a4\u4f60\u7684\u6570\u636e\u7684\uff0c\u4e0b\u4e00\u7bc7\u6211\u4eec\u4ece\u5b9e\u9645\u5e94\u7528\u7684\u89d2\u5ea6\uff0c\u6765\u770b\u770b\u8be5\u600e\u4e48\u5c06 KMS \u5177\u4f53\u5e94\u7528\u5230\u4f60\u7684\u7cfb\u7edf\u4e2d\u3002<\/p>\n<\/p><\/div>\n

        \u5927\u4f6c\u6709\u8a71\u8aaa<\/b> (5<\/span>) <\/div>\n
        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n
          \n
        • \n
          \n
          \n
          \u8cc7\u6df1\u5927\u4f6c : ivyliner <\/span> <\/div>\n
          <\/i> <\/span> <\/div>\n<\/p><\/div>\n
          \u6700\u7ec8\u7684\u5b58\u50a8\u5728\u5185\u5b58\u4e2d, \u5982\u679c\u673a\u5668\u6545\u969c\u7684\u8bdd, \u8fd9\u4e2a key \u4e22\u5931\u4e86\u600e\u4e48\u89e3\u5bc6 ? <\/div>\n<\/p><\/div>\n<\/li>\n
        • \n
          \n
          \n
          \u8cc7\u6df1\u5927\u4f6c : Had <\/span> <\/div>\n
          <\/i> <\/span> <\/div>\n<\/p><\/div>\n
          HSM \u751f\u6210 Master Key
          HSM \u8981\u5408\u89c4\uff0c\u6240\u4ee5\u5728\u4e2d\u56fd\u4f7f\u7528\u7684\u5bc6\u7801\u673a\u548c Global \u4e0d\u4e00\u6837 <\/div>\n<\/p><\/div>\n<\/li>\n
        • \n
          \n
          \n
          \u8cc7\u6df1\u5927\u4f6c : Had <\/span> <\/div>\n
          <\/i> <\/span> <\/div>\n<\/p><\/div>\n
          @ivyliner \u8fd9\u4e2a\u8bbe\u8ba1\u5c31\u6bd4\u8f83\u590d\u6742\u4e86\uff0c\u53ef\u4ee5\u53c2\u8003\u767d\u76ae\u4e66
          https:\/\/d0.awsstatic.com\/whitepapers\/KMS-Cryptographic-Details.pdf <\/div>\n<\/p><\/div>\n<\/li>\n
        • \n
          \n
          \n
          \u8cc7\u6df1\u5927\u4f6c : kidlj <\/span> <\/div>\n
          <\/i> <\/span> <\/div>\n<\/p><\/div>\n
          \u5f88\u6e05\u6670\uff0c\u8c22\u8c22\u3002 <\/div>\n<\/p><\/div>\n<\/li>\n
        • \n
          \n
          \n
          \u8cc7\u6df1\u5927\u4f6c : cyd <\/span> <\/div>\n
          <\/i> <\/span> <\/div>\n<\/p><\/div>\n
          \u590d\u5236\u9ecf\u8d34\u4e5f\u5f97\u7528\u70b9\u5fc3\u3002\u3002
          1.\u56fe\u6ca1\u4e86\u3002
          2.\u79d1\u666e\u5b8c\u5bf9\u79f0\u975e\u5bf9\u79f0\uff0c\u7136\u540e\u4e0b\u6587\u5b8c\u5168\u6ca1\u8bf4\u4f7f\u7528\u7684\u662f\u54ea\u79cd\u65b9\u5f0f\u3002
          3.\u7528\u6237\u603b\u6709\u63a5\u53e3\u9700\u8981\u8c03\u7528\u83b7\u53d6\uff0c\u8fd9\u5757\u7684\u63a5\u53e3\u5b89\u5168\u76f8\u5173\u4fe1\u606f\u5462\u3002 <\/div>\n<\/p><\/div>\n<\/li>\n
        • \n","protected":false},"excerpt":{"rendered":"

          AWS KMS \u79d1\u666e: What …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/128063"}],"collection":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=128063"}],"version-history":[{"count":0,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/128063\/revisions"}],"wp:attachment":[{"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=128063"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=128063"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=128063"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}