aws-cloudformation - AWS CloudFormation - 正确使用 AWS::KMS::Key 中的默认 key 策略

Question

我正在尝试使用默认 key 策略部署 KMS CMK。根据文档，如果您在创建 key 时未指定策略，AWS 将使用默认 key 策略。但是，使用 CloudFormation 时，需要 Property KeyPolicy。有人知道如何在 KeyPolicy 语句中指定默认策略还是我遗漏了什么？

我正在尝试根据 documentation 创建一个 AWS::KMS::Key 资源。应该能够使用默认 key 策略作为KeyPolicy属性，但是，正如文档所述:

If you are unsure of which policy to use, consider the default key policy. This is the key policy that AWS KMS applies to KMS keys that are created by using the CreateKey API with no specified key policy. It gives the AWS account that owns the key permission to perform all operations on the key. It also allows you write IAM policies to authorize access to the key. For details, see Default key policy in the AWS Key Management Service Developer Guide.

不幸的是，KeyPolicy 资源被标记为具有必需值，而使用默认 key 策略则明确要求不传递任何值。 当 KeyPolicy 属性需要传递值时，如何使用默认 key 策略？

Answer 1

经过对此进行更多研究，处理此问题的正确方法似乎是将默认 key 策略强加到实际 CloudFormation 属性中的等效项传递给实际的 CloudFormation 属性。

考虑以下documentation关于默认 key 策略:

The following default key policy statement is critical.

It gives the AWS account that owns the KMS key full access to the KMSkey.

Unlike other AWS resource policies, a AWS KMS key policy does notautomatically give permission to the account or any of its users. Togive permission to account administrators, the key policy must includean explicit statement that provides this permission, like this one.

It allows the account to use IAM policies to allow access to the KMSkey, in addition to the key policy.

Without this permission, IAM policies that allow access to the key areineffective, although IAM policies that deny access to the key arestill effective.

It reduces the risk of the key becoming unmanageable by giving accesscontrol permission to the account administrators, including theaccount root user, which cannot be deleted.

The following key policy statement is the entire default key policyfor KMS keys created programmatically. It's the first policy statementin the default key policy for KMS keys created in the AWS KMS console.

最后一行特别揭示了答案:

以下 key 策略语句是以编程方式创建的 KMS key 的完整默认 key 策略。这是在 AWS KMS 控制台中创建的 KMS key 的默认 key 策略中的第一个策略语句。

{
  "Sid": "Enable IAM policies",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:root"
   },
  "Action": "kms:*",
  "Resource": "*"
}

因此，由于 CloudFormation AWS::KMS::Key 中的 KeyPolicy 字段是必需的，因此要传入默认 key 策略，您需要提交上述内容通常会为您创建的代码块(如果您在没有显式 KeyPolicy 的情况下调用 KMS API)。