Question

我一直在尝试通过aws kms cli将Principal动态添加到AWS KMS Policy语句中，我非常认真，AWS文档是有史以来最糟糕的文档之一！

任何人都知道如何以编程方式（使用aws kms或任何其他替代方法）将Principal添加到下面的政策声明中吗？

{
    "Version": "2012-10-17",
    "Id": "key-consolepolicy-3",
    "Statement": [
        {
            "Sid": "Allow access for Key Administrators",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    // I need to programatically add the ARN role here
                ]
            },
            "Action": [
                "kms:Create*",
                "kms:Describe*",
                "kms:Enable*",
                "kms:List*",
                "kms:Put*",
                "kms:Update*",
                "kms:Revoke*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Delete*",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:ScheduleKeyDeletion",
                "kms:CancelKeyDeletion"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow use of the key",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    // I need to programatically add the ARN role here
                ]
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow attachment of persistent resources",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    // I need to programatically add the ARN role here
                ]
            },
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        }
    ]
}

Answer 1

不可能使用CLI将新的主体添加到资源策略。但是，您可以使用put-key-policy命令用新版本替换密钥策略。

动态添加主体的最佳方法是利用代码生成技术来生成关键策略。我通常在Jinja2中使用Python。

可以使用以下命令将生成的策略附加到CMK：

aws kms put-key-policy \
    --policy-name default \
    --key-id <kms-key-id> \
    --policy file://new_key_policy.json

AWS KMS密钥策略-如何添加主体

1 个答案: