Question

我正在使用Terraform设置S3存储桶（不同区域）并在它们之间设置复制。

在我添加KMS之前，它一直工作正常。

我创建了2个KMS密钥，一个用于源，另一个用于目的地。

现在在应用复制配置时，可以通过一个选项为目标存储桶传递目标密钥，但是我不确定如何在源位置应用密钥。

任何帮助将不胜感激。

provider "aws" {
  alias  = "east"
  region = "us-east-1"
}

resource "aws_s3_bucket" "destination-bucket" {
  bucket = ""destination-bucket"
  provider = "aws.east"
  acl    = "private"
  region   = "us-east-1"
  versioning {
    enabled = true
  }
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = "${var.kms_cmk_dest_arn}"
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

resource "aws_s3_bucket" "source-bucket" {
  bucket = "source-bucket"
  acl    = "private"
  versioning {
    enabled = true
  }
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = "${var.kms_cmk_arn}"
        sse_algorithm     = "aws:kms"
      }
    }
  }
  replication_configuration {
    role = "${aws_iam_role.replication.arn}"

    rules {
      status = "Enabled"
	  destination {
        bucket        = "${aws_s3_bucket.source-bucket.arn}"
        storage_class = "STANDARD"
		replica_kms_key_id = "${var.kms_cmk_dest_arn}"
      }
	  source_selection_criteria {
      sse_kms_encrypted_objects {
      enabled = true
	  }
    }
    }
  }
}

resource "aws_iam_role" "replication" {
  name = "cdd-iam-role-replication"
  permissions_boundary    = "arn:aws:iam::${var.account_id}:policy/ServiceRoleBoundary"
  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy" "replication" {
  name = "cdd-iam-role-policy-replication"
  role = "${aws_iam_role.replication.id}"

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:GetReplicationConfiguration",
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": [
        "${aws_s3_bucket.source-bucket.arn}"
      ]
    },
    {
      "Action": [
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl"
      ],
      "Effect": "Allow",
      "Resource": [
        "${aws_s3_bucket.source-bucket.arn}/*"
      ]
    },
    {
      "Action": [
        "s3:ReplicateObject",
        "s3:ReplicateDelete"
      ],
      "Effect": "Allow",
      "Resource": "${aws_s3_bucket.destination-bucket.arn}/*"
    }
  ]
}
POLICY
}

Answer 1

如果您要使用客户管理密钥（CMK）进行S3加密，则需要进行额外的配置。 AWS S3文档提到，CMK所有者必须授予源存储桶所有者使用CMK的权限。

https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-config-for-kms-objects.html#replication-kms-cross-acct-scenario

另外，一篇很好的文章总结了S3跨区域复制配置：

https://medium.com/@devopslearning/100-days-of-devops-day-44-s3-cross-region-replication-crr-8c58ae8c68d4

Answer 2

如果我对您的理解正确，那么您在同一帐户的两个不同区域中都有两个S3存储桶。

过去我做过的一种方法是首先将KMS密钥计划/应用到两个区域。

然后在单独的计划/应用中，我使用了Terraform的数据源：

data "aws_kms_key" "source_credentials_encryption_key" {
  key_id = "alias/source-encryption-key"
}
    
data "aws_kms_key" "destination_credentials_encryption_key" {
  provider = aws.usEast
  key_id   = "alias/destination-encryption-key"
}

并将数据源用于复制配置，如下所示：

replication_configuration {
  role = aws_iam_role.replication_role.arn
  
  rules {
    status = "Enabled"
    
    destination {
      bucket = aws_s3_bucket.source_bucket.arn
      storage_class = "STANDARD"
      replicate_kms_key_id = data.aws_kms_key.destination_bucket_encryption_key.arn
    }
    
    source_selection_criteria {
      sse_kms_encrypted_objects {
        enabled = true
      }
    }
  }
}

使用Terraform的S3跨区域复制

2 个答案: