Amazon EC2 example one - AWS Key Management Service

Amazon EC2 example one

The following example demonstrates an IAM user creating an encrypted volume using the default volume key in the Amazon EC2 management console.

The following example shows a CloudTrail log entry that demonstrates the user Alice creating an encrypted volume using a default volume key in AWS EC2 Management Console. The EC2 log file record includes a volumeId field with a value of "vol-13439757". The AWS KMS record contains an encryptionContext field with a value of "aws:ebs:id": "vol-13439757". Similarly, the principalId and accountId between the two records match. The records reflect the fact that creating an encrypted volume generates a data key that is used to encrypt the volume content.

{ "Records": [ { "eventVersion": "1.02", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "sessionContext": { "attributes": { "mfaAuthenticated": "false", "creationDate": "2014-11-05T20:40:44Z" } }, "invokedBy": "" }, "eventTime": "2014-11-05T20:50:18Z", "eventSource": "", "eventName": "CreateVolume", "awsRegion": "us-east-1", "sourceIPAddress": "", "userAgent": "", "requestParameters": { "size": "10", "zone": "us-east-1a", "volumeType": "gp2", "encrypted": true }, "responseElements": { "volumeId": "vol-13439757", "size": "10", "zone": "us-east-1a", "status": "creating", "createTime": 1415220618876, "volumeType": "gp2", "iops": 30, "encrypted": true }, "requestID": "1565210e-73d0-4912-854c-b15ed349e526", "eventID": "a3447186-135f-4b00-8424-bc41f1a93b4f", "eventType": "AwsApiCall", "recipientAccountId": "123456789012" }, { "eventVersion": "1.02", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "sessionContext": { "attributes": { "mfaAuthenticated": "false", "creationDate": "2014-11-05T20:40:44Z" } }, "invokedBy": "AWS Internal" }, "eventTime": "2014-11-05T20:50:19Z", "eventSource": "", "eventName": "GenerateDataKeyWithoutPlaintext", "awsRegion": "us-east-1", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": { "encryptionContext": { "aws:ebs:id": "vol-13439757" }, "numberOfBytes": 64, "keyId": "alias/aws/ebs" }, "responseElements": null, "requestID": "create-123456789012-758241111-1415220618", "eventID": "4bd2a696-d833-48cc-b72c-05e61b608399", "readOnly": true, "resources": [ { "ARN": "arn:aws:kms:us-east-1:123456789012:key/e29ddfd4-1bf6-4e1b-8ecb-08216bd70d07", "accountId": "123456789012" } ], "eventType": "AwsApiCall", "recipientAccountId": "123456789012" } ] }