amazon-web-services - 强制执行新 EBS 卷的 AWS IAM 策略已加密

Question

在 AWS Key Management Service Best Practices whitepaper ，在有关使用 Amazon EBS 进行静态数据加密的部分中，它指出:

There are two methods to ensure that EBS volumes are always encrypted. You can verify that the encryption flag as part of the CreateVolume context is set to “true” through an IAM policy. If the flag is not “true” then the IAM policy can prevent an individual from creating the EBS volume

我怎样才能做到这一点？我想这个政策会是这样的:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1509465260000",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVolume"
      ],
      "Condition": {
        "Bool": {
          "ec2:Encrypted": "true"
        }
      },
      "Resource": [
        "*"
      ]
    }
  ]
}

基于白皮书和 docs , Bool ec2:Encrypted 上的条件key 最有意义，但是在尝试创建加密卷时，我的访问被拒绝。

我在声明中遗漏了什么？

Answer 1

您将需要额外的权限来创建加密卷:

1) ec2:DescribeAvailabilityZones

2) 公里数:*

注意:我没有深入了解 KMS 以了解使用 KMS 加密 key 的最低权限。如果要从快照创建卷，则需要添加 ec2:DescribeSnapshots .

示例政策:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeAvailabilityZones"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Stmt1509465260000",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVolume"
            ],
            "Condition": {
                "Bool": {
                    "ec2:Encrypted": "true"
                }
            },
            "Resource": [
                "*"
            ]
        }
    ]
}