狠狠撸

? 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
? ? ?
AWS Korea / Solutions Architect
AWS KMS? ???? ???
AWS ??? ???? ??
??

??
AWS ??? ??
? ?? ? ??? ???
? ?? ? ??? ???
KMS ?? ????
? Infrastructure ??
? IAM ??
? ?? ?? ??
? ??? ?? ??
? ?? ?? ??

AWS ??? ??

??????? ???
???? ??:
? ?? ??? ??
? ?? ????? ??? ??
? ???? ?????? ? ???? ???? ??
? ???? ???? ?? ???? ?? ? ???? ???? ??
IT ?? ??
? ??
?? ??
????? ??? ?? ???
?? ? ??
??? ??
??? ???
?? ??? ??

AWS ???? ???? ?? ??? ??
??? ??
? ??? ??
? ???? ?? ?? – ??? ??
??? ??, TLS, IPsec
? ??/?? ?? - AWS Snowball
? ??? ??
? ??? ?? ??? ????
? ?? ??? – ??? ??, ??,
????, ?? ???, ?? ???
? ??? ??
? ??? ?? ??? ???? - CCTV
??? ??
? ??? ??
? ???? ???? – VPC, Security
Groups, NACL ?
? ?? ??? – TLS, IPsec
? ??? ??
? ??? ???? ?? ??? ?? ??
? ??? ??? – ?? ???? ??
??? ??, ??, ????, ?? ???,
?? ??? ???
? ??? ??
? ???? ?? ??? ???? – FIPS
140-2 ?? ??

?? ? ??? ???

??? ??? ? ???? ?? TLS??
??? ?? ??? ???? ????? ??:
Amazon EC2? ???? ?? ????????
Elastic Load Balancing (CLB/ALB) ???
Amazon CloudFront ???
Amazon API Gateway ???

AWS Certificate Manager (ACM)
? ??? AWS ????? ?? TLS??? ??:
? Elastic Load Balancing (CLB/ALB)
? Amazon CloudFront
? Amazon API Gateway
? AWS Elastic Beanstalk
??? ??/??/??/?? ??? AWS? ???
? ? ??? ???? ?? ?? ?? ??
? ??? ??? ? ??? ?? ??
? ??? ??? ?? ??
DNS ?? ? ??? ??? ?? ??? ??(DV)
Transparency Log ?? ??

AWS ACM Private Certificate Authority
?? SSL/TLS ??? ????(CA)? ????? ??
? ?? ??? ???, API G/W, SSL VPN, IoT ?? ?
???? ??? ????
? RSA 2048 / RSA 4096 / ECDSA P256 / ECDSA P384
??? ???? PKI ??? AWS? ???
? ??CA ???? ???? ??
? ???? ??? ??(FIPS 140-2 Level 3? ???? HSM)
? ??? ?? ??(CRL)?? ??
?? ??
? N. Virginia, Ohio, Oregon, Singapore, Sydney, Tokyo, Canada, Frankfurt, Ireland

TLS? ? ???? ?? – S2N
? ?? ?? ??? ?? ??? ?? AWS? ??? TLS ?????
? SSL v3 / TLS 1.0 / TLS 1.1 / TLS 1.2
? ?? ???? ?? TLS ??? ??(extension) ??? ??; ~6,000 ??
??? ??
? ??? AWS?????? ?????, ?? ??? ??
https://github.com/awslabs/s2n

Virtual Private Networking
AWS ??? VPN
??? VPC? ?? ??? ???? IPsec ?? VPN?? ??.
AWS VPN CloudHub
??? VPC? ???? ??? ???? IPsec ???? ???? ?? VPN ??.
??? ?? ????? ?? VPN
EC2??? VPN S/W? ???? ??? ???? ??.

??? ??? ??? ??
??
???
???? /
?????
????
???
?????
??? ??
????
??? ?
??? ?
(???)
??? ???? ?
(???)
? ?? ??
? ????
?
?? ???(Envelop Encryption)

AWS?? ??? ???? ???? 2?? ??
????? ? ???(Client-Side Encryption)
? ???? ???? ?? ??? ??
? ??? ?? ??? ?? ???? ?? ?????, AWS KMS/CloudHSM??
?? ??
? ???: AWS Encryption SDK, S3 Encryption Client, EMRFS Client, DynamoDB
Encryption Client
?? ? ???(Server-Side Encryption)
? AWS? ??? ???? ?? ?? ?? ?? ??? ??? ?? ??
? ? 34 ? ??? ?? : Amazon S3, Amazon EBS, Amazon RDS, Amazon Redshift,
Amazon WorkSpaces, Amazon Kinesis Streams, AWS CloudTrail…
? ?? ?? ?? ?? AWS KMS? ??? ? ??

????? ? ???(Client-Side Encryption)
A W S E n c r y p t i o n S D K , S 3 / E M R F S / D y n a m o D B c l i e n t s , c u s t o m e r - s u p p l i e d
?? IDC?
??
??????
EC2?? ??
??? ???
??? ?? ?????
??? ??? ??? EC2?? ??
??????
AWS??? ?? ???? ???
AWS
KMS
AWS
CloudHSM

AWS Encryption SDK
??? ????, ???? ?? 2?? ??? ??:
? ??? ? ???/??/??????
? ??? ??? ???? ??? ? ???(key provider)
SDK? ??? ???? ???????? ??
? ?? ???? ???? ?? ???? ???
? ???? ?? KMS Limit? ???? ?? ??? ? ?? ??? ???? KMS?? ???
??
?? Java, Python, CLI ?? ??
http://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/introduction.html

?? ? ???(Server-Side Encryption)
2?? ? ??? ?? ???(envelope
encryption)
? ???? ?????? ???? ??? ?
? KMS ??? ?? ?? ??? ?? ???
??
? ??? ?? ?? ?? ??
? ??? ??? ???? ?? ?? ??
? ??? ??? ???? ?? ?? ??
??? ?? ?? ????? ???
? ? ?? ??? ?? ?? ??? ?????
??
CMK(?? ??? ?)
????1
S3 ?? EBS ??
Amazon
Redshift
????
????2 ????3 ????4
??
??????
KMS

AWS KMS? ? ???? ??
KMS? ??
KMS ??? ??? ?
? ?? ?? ?? HSA(Hardened Security Appliances)?
CMK? ????? ?? ??? ??? ??? ?? ??.
? ?? ??? ??? ?? ?? CMK? ? ???.
????
Keys on HSAs in a Region
??? ?(CMK)
? 256-bit ????, HSA? ????? ??? ???? Import?.
? ???? ?? KMS??? ???? Copy? ????, ???
? ??? ?, ?? CMK? ??? HSA ??? ??? ???.
????
??? ?(CMK)
??? ?
? 256-bit ????, ??? ?/???? ???
? AWS???/?? ???????? ???? ??? ?? ???
?? ???? ???.
??? ?

CMK(??? ?) ??
AWS ??? CMK ?? ??? CMK
?? AWS??? ???? KMS? ???
AWS??? ? 1?
AWS??? ???? KMS? ??? AWS??? ?
???
?? AWS? ?? ??? ?? ????? ???
?? ? 3? ?? ???? ?? 1?? ???? ?? ?? ?? ???? ?? ??
?? ?? ?? ?? ??
?? ?? ?? AWS ???? ??? CMK / IAM ??? ?? ?? ??
Key ?? AWS? ?? ??? ??
??? ?? IAM ???? ?? IAM ???? ??

AWS ????? KMS? ???? ??
EC2/EBS ??
? EBS ?? ?? ??? ?? ????, CMK? ???? ? ?? ?????? ??
? ??? EBS???? EC2? ?? ?? ??, ?? EBS??? ?????? ???? ??
??? ?? ??????? ??? ??? ?? ?? è ??, I/O, ???? ???
? ?? ???: EBS, RDS, Redshift, WorkSpaces, Amazon Lightsail
S3 ??
? S3? 3?? ?? ? ??? ? SSE-KMS ??
? ?? ?? ??? ?? ????, CMK? ???? ?, ?? ?????? ??
? ??? ?? ???? S3 ???? ??? ??? ??? ???? ?? ??? ?? ?? ?
?? ???.
? ????? Get??? ?? S3? KMS??? ???? ??? ?? CMK? ???? ???
????, ???? ??? ?? ??? ?? ??? ??? ? ?, ?? ? ???.
? ?? ???: S3, EMR, CloudTrail, Amazon Athena, Amazon Kinesis, Amazon SQS,
Amazon CloudWatch

??? ?? CMK(??? ?) ????? ??
??? ?? CMK ?? ??? ?? ????? ? ??(CMK Policy)??
??
? ?? ??:
? <??? ????>? <??? ???? Role>?? ?/??? ??
? ?????? A??? ???? ?????, ?????? B??? ? ????
???? ? ??.
? ??? ?? ?? ?? Role? ?? ?????.
? <??? ????>?? ?/??? ??? ??? ? ???, ??
????(??/??/????/?? ?)? ??.
AWS Identity and Access Management? ??

CloudTrail?? CMK(??? ?) ????
"EventName":"DecryptResult", …??? API
"EventTiime":"2014-08-18T18:13:07Z", ….??? ??
"RequestParameters":
"{"keyId":"2b42x363-1911-4e3a-8321-6b67329025ex”}”, …??? ?? ?? ??
“EncryptionContext":"volumeid-12345", …?? ??? AWS ???
"SourceIPAddress":" 203.0.113.113", …???? IP??
"UserIdentity":
“{"arn":"arn:aws:iam:: 111122223333:user/User123“} …???? ??

?? ????? ???
Amazon EBS
Amazon RDS
Amazon Redshift
Amazon S3
Amazon Glacier
?? ? ???
AWS
CloudTrail
IAM
??
?? ??
??? ?? ??????
?? ? ???
KMS? ??
?? ???
???
???? ?
?? ???
???

KMS ?? ????

AWS Cloud Adoption Framework
5 ?? ?? ?? ??
??? ??
??? ? ?? ??
?? ??
??? ??
?? ??
??? ? ?? ? ??? ??
??? ? ?? ??? ??
????? ?? ?? ?? ?? ?? ??
??? ?? ?? ?? ?? ???
? ?? ???? ?? ???? ?? ? ??
???? ??? ???

Infrastructure ??

KMS? ??? ?? ??
KMS HSA? ??? ??? ?:
? AWS ???? ?? ???? ?? ???.
? ??? ????? ????/??? ?? ??.
HSA? reboot??? ? ???? ??:
? ??? ?? ? ???? ?? ??? ??.
? ????? ????/?? ?? ??:
? ??? AWS???? ??? ??? ???.
? ??? ???? ??? ????? ??? ???? ??? ???.
3rd Party??
? SOC 1 – Control 4.5: “KMS?? ??? ??? ??? CMK? ???? ????
??? ? ??? ????? ????.“
Keys on HSAs in a Region

AWS KMS? ??? ??
? ??? ????(cryptographic material)? ??? ??????
???.
? ?? KMS API??? ?? TLS PFS(Perfect Forward Secrecy) ??.
? KMS ???? ?? CMK? ??? ? ?? ?? ??/??? ??

CMK(??? ?) ?? ? ??
? ??, ??? ??, ?? ?? ?? ?? ??? ?? ???? ??.
? ?? ???? ????? ??? ??? ?? ?????? ?? ??? ?? ??
? ?? ? ??(Retention) ?? ??
? ? ?????? ? ID, ARN, ??, ??/?? ?? ??? ???
? Old?? ?? ?? ???? ???? ??? ???? ?? ???.
Security Account
111111111111
Analytics Account
333333333333
Application Account
222222222222
Bank App CMK Analytics CMK

IAM ??

CMK(??? ?) ?? ??

CMK(??? ?) ??? ????
? ??? ?? ?? - CMK ??? ??
? 3?? ??
? CMK ??? ?? – ?? ?? ???? ??? ??? ??? ??? ??.
? CMK ??? IAM ??? ?? ??(??) – ?? ? ???? ??? ??.
? CMK ??? ‘Grants’??(??) – ?? ???? ?? AWS ???? ? ??? ??.
? ?? CMK ??? ?? ?? ??? ??? ??? ?!
? ? - ? ??/?? ??? ? ?? ??? ???? ?? ??
? IAM ???? ? ??? KMS action? ??(No kms:*)
? ?? ?? ?? ??? ?? White-listing ?? ?? ?? ??
? ??? ??? ? ??? Deny ??, NotPrincipal + Effect:Deny

CMK ??: Key??? vs. Key???
{
"Sid": "Allow access for Key Administrators",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::111111111111:user/KMSAdminUser",
"arn:aws:iam::111122223333:role/KMSAdminRole”
]},
"Action": [
"kms:Create*", "kms:Describe*",
"kms:Enable*", "kms:List*",
"kms:Put*", "kms:Update*",
"kms:Revoke*", "kms:Disable*”,
"kms:Get*", "kms:Delete*",
"kms:TagResource", "kms:UntagResource",
"kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion”
],
"Resource": "*”
}
{
"Sid": "Allow use of the key",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::111122223333:user/KMSUser",
"arn:aws:iam::111122223333:role/KMSRole",
"arn:aws:iam::444455556666:root" ]},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey”
],
"Resource": "*"
}

???? ? ? ?? CMK ??
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::222222222222:root”
},
"Action": "kms:*",
"Resource": "*"
}
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::222222222222:root”
"AWS": "arn:aws:iam::222222222222:role/CMKAdmin”
.....
},
"Action": "kms:*",
"Resource": "*"
}
Option 1.
Option 2.
:: ??? ?????
????? ??? IAM
user/role ?? ?? ???
??(?? ??)
:: ? ?? ??????
CMK ??? ?????
Principal? ????
???? ??

Grants ??
? Grants: AWS ??? ?? ?? ???? CMK??? ???? ?? ?? ??
??? ?????? ???? ??
? ??!! Grant Limit
? CMK(*) ? Grant Limit :: 2,500?
:: ??? CMK? ???? ???? ???? 2,500? ??? ??
(EBS?? ?)
? CMK(*) ? ?? ?? ??(Principals)? ?? Grants Limit :: 500?
:: ??? CMK? ???? ?? EC2 ????? ???? EBS???
500? ?? ??
(* ??? ?? upload ? CMK? ??, AWS ??? CMK? ?? ??)

ViaService
‘kms:ViaService’: ? ?? Condition? ??. ?? ?????? ?????? ??
{
"Sid": "Allow use of CMK via RDS",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::222222222222:role/MortgageApp”,
},
"Action" : [ "kms:ListGrants", "kms:CreateGrant",
"kms:Decrypt", "kms:GenerateDataKey*", "kms:ReEncrypt*", "kms:DescribeKey", "kms:Encrypt" ],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"kms:ViaService" : "rds.us-west-1.amazonaws.com"
}
}
},
? : R D S ? ? ? ? C M K ? ? ? ? ? ?

MFA ??
? :: ?? KMS API ??? ?? 5? ?? MFA??? ???? ??
{
"Sid": "MFACriticalKMSEvents",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:user/ExampleUser"
},
"Action": [
"kms:DeleteAlias”, "kms:DeleteImportedKeyMaterial", "kms:PutKeyPolicy", "kms:ScheduleKeyDeletion"
],
"Resource": "*",
"Condition":{
"NumericLessThan” :{
"aws: MultiFactorAuthAge":"300”
}
}
}

?? ?? ??

?? ?????? CloudTrail ?? ??
?? ????
111111111111
?? ????
333333333333
?????? ????
222222222222
AWS
CloudTrail
AWS
CloudTrail AWS
CloudTrail
????
??

???? AWS Config Rules
???? ?? ??
? cloudTrail-enabled
? encrypted-volumes
? rds-storage-encrypted
? s3-bucket-public-read-prohibited
? s3-bucket-public-write-
prohibited
? s3-bucket-ssl-requests-only

CMK Tagging
? CMK?? ????/??/???? ?? ??? ??
? ??? ??? ?? ??? CMK??
? CloudTrail?? ?? ??? ?? CMK? ???? ?????? ?? ??

?????

Application Design(??)
?? ????
333333333333
?????? ????
222222222222
Amazon S3
Amazon S3
???? RDS ???
Amazon
RDS
AWS
Encryption SDK
??? ???
??? ???
AWS Encryption SDK

Encryption Context
AWS KMS? ??? ???? ?????? ?? ????(Key-value pair)
? ???? ???? ?? ?? ?? è ??? ? ???? ?? ?? ??/???
??(??? ??? ???? ??)
? ?? ??? ?? ??? ??? ?? ?? ??
? Encryption Context? CloudTrail?? ???? ??? è ?? ?? ??? ???? ??
? CMK??? Condition?? ??
{
"Effect": "Allow",
"Principal": { "AWS": "arn:aws:iam::111122223333:role/RoleForExampleApp" },
"Action": [ "kms:Encrypt", "kms:Decrypt" ],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:EncryptionContext:AppName": "ExampleApp",
"kms:EncryptionContext:Version": "1.0.24"
}
}
}

?? KMS API??? ?? ??

?? API? ?? Alerting

AWS KMS ?? ????
AWS KMS
Cryptographic Details
https://d0.awsstatic.com/whitepa
pers/KMS-Cryptographic-
Details.pdf
AWS KMS Best
Practices Whitepaper
https://d0.awsstatic.com/whitepa
pers/aws-kms-best-practices.pdf
AWS KMS Compliance
Reports
https://aws.amazon.com/artifact/

AWS Summit ??? ?? QR???
?? ?? ?? ? ?? ??? ???
??? ????.
?? Summit? ?? ???? ???
?? ?? ????.
#AWSSummit ????? ?? ???? ???? ??
??? ?????.
?? ?? ? ?? ???? AWS Korea ?? ?? ???
??? ?????.
???? ???? ?????!

狠狠撸

AWS KMS? ???? ??? AWS ??? ???? ?? ??::???::AWS Summit Seoul 2018

Recommended

More Related Content

What's hot (20)

Similar to AWS KMS? ???? ??? AWS ??? ???? ?? ??::???::AWS Summit Seoul 2018 (20)

More from Amazon Web Services Korea (20)

AWS KMS? ???? ??? AWS ??? ???? ?? ??::???::AWS Summit Seoul 2018