如何 AWS CloudTrail 使用 AWS KMS - AWS Key Management Service
了解您的KMS密钥何时被使用

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

如何 AWS CloudTrail 使用 AWS KMS

您可以使用 AWS CloudTrail 为您录制 AWS API通话和其他活动，并将录制的信息保存到您 AWS 账户 选择的亚马逊简单存储服务 (Amazon S3) Service 存储桶中的日志文件中。默认情况下， CloudTrail 放入 S3 存储桶的日志文件使用服务器端加密和 Amazon S3 托管加密密钥 (-S3) 进行加密。SSE但是你可以选择使用带有密KMS钥 (SSE-KMS) 的服务器端加密。要了解如何使用加密 CloudTrail 日志文件 AWS KMS，请参阅AWS CloudTrail 用户指南中的使用 AWS KMS keys (SSE-KMS) 加密 CloudTrail 日志文件。

重要

AWS CloudTrail 而且 Amazon S3 仅支持对称模式 AWS KMS keys。您不能使用非对称KMS密钥来加密您的 CloudTrail 日志。有关确定KMS密钥是对称还是非对称的帮助，请参阅。识别非对称 KMS 密钥

CloudTrail 读取或写入使用 SSE-密钥加密的日志文件时，您无需支付KMS密钥使用费。但是，当您访问使用 SSE-密钥加密的 CloudTrail 日志文件时，您需要支付KMS密钥使用费。有关 AWS KMS 定价的信息，请参阅AWS Key Management Service 定价。有关 CloudTrail 定价的信息，请参阅AWS CloudTrail 用户指南中的定AWS CloudTrail 价和管理成本。

了解您的KMS密钥何时被使用

使用基于 Amazon S3 的 AWS KMS 构建功能加密 CloudTrail 日志文件，该功能称为服务器端加密，带有 AWS KMS key (SSE-KMS)。要了解有关 SSE-的更多信息KMS，请参阅Amazon Simple Storage Service (Amazon S3) 如何使用 AWS KMS本指南或《亚马逊简单存储服务用户指南》中的 “使用带有KMS密钥 (SSE-KMS) 的服务器端加密保护数据。

当您配置 AWS CloudTrail 为使用 SSE-KMS 来加密您的日志文件时， CloudTrail Amazon S3 AWS KMS keys 会在您使用这些服务执行某些操作时使用您的。以下各节说明了这些服务何时以及如何使用您的KMS密钥，并提供了可用于验证此解释的其他信息。

您配置 CloudTrail 为使用您的日志文件进行加密 AWS KMS key

当您更新 CloudTrail配置以使用您的KMS密钥时， CloudTrail 会向发送GenerateDataKey请求 AWS KMS 以验证KMS密钥是否存在以及是否 CloudTrail 有权使用它进行加密。 CloudTrail 不使用生成的数据密钥。

GenerateDataKey 请求包括加密上下文的以下信息：

该GenerateDataKey请求会在您的 CloudTrail 日志中生成一个类似于以下示例的条目。当你看到这样的日志条目时，你可以确定那个 CloudTrail ( Red circle with number 1 inside, indicating a numerical step or priority. ) 为特定的跟踪 AWS KMS ( Red circle with number 2 inside, likely representing a step or item in a sequence. ) 调用了 () GenerateDataKey 操作 ( Red circle with number 4 inside, likely representing a notification or count indicator. )。 Red circle with number 3 inside, indicating a step or sequence number. AWS KMS 在特定密钥 ( Red circle with white number 3 inside, indicating a step or sequence number. ) 下创建了数据KMS密钥。

注意

您可能需要滚动到右侧以查看以下示例日志条目中的某些标注。

{
  "eventVersion": "1.02",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDACKCEVSQ6C2EXAMPLE",
    "arn": "arn:aws:iam::086441151436:user/AWSCloudTrail",Red circle with number 1 inside, indicating a numerical step or priority.
    "accountId": "086441151436",
    "accessKeyId": "AKIAI44QH8DHBEXAMPLE",
    "userName": "AWSCloudTrail",
    "sessionContext": {"attributes": {
      "mfaAuthenticated": "false",
      "creationDate": "2015-11-11T21:15:33Z"
    }},
    "invokedBy": "internal.amazonaws.com"
  },
  "eventTime": "2015-11-11T21:15:33Z",
  "eventSource": "kms.amazonaws.com",Red circle with number 2 inside, likely representing a step or item in a sequence.
  "eventName": "GenerateDataKey",Red circle with number 3 inside, indicating a step or sequence number.
  "awsRegion": "us-west-2",
  "sourceIPAddress": "internal.amazonaws.com",
  "userAgent": "internal.amazonaws.com",
  "requestParameters": {
    "keyId": "arn:aws:kms:us-west-2:111122223333:alias/ExampleAliasForCloudTrailKMS key",
    "encryptionContext": {
      "aws:cloudtrail:arn": "arn:aws:cloudtrail:us-west-2:111122223333:trail/Default",Red circle with number 4 inside, likely representing a notification or count indicator.
      "aws:s3:arn": "arn:aws:s3:::example-bucket-for-CT-logs/AWSLogs/111122223333/"
    },
    "keySpec": "AES_256"
  },
  "responseElements": null,
  "requestID": "581f1f11-88b9-11e5-9c9c-595a1fb59ac0",
  "eventID": "3cdb2457-c035-4890-93b6-181832b9e766",
  "readOnly": true,
  "resources": [{
    "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",Red circle with white number 3 inside, indicating a step or sequence number.
    "accountId": "111122223333"
  }],
  "eventType": "AwsServiceEvent",
  "recipientAccountId": "111122223333"
}

CloudTrail 将日志文件放入您的 S3 存储桶

每次 CloudTrail 将日志文件放入您的 S3 存储桶时，Amazon S3 都会代表向发送GenerateDataKey请求 CloudTrail。 AWS KMS 为响应此请求， AWS KMS 生成一个唯一的数据密钥，然后向 Amazon S3 发送两份数据密钥副本，一份为纯文本，另一份使用指定KMS密钥加密。Amazon S3 使用纯文本数据密钥对 CloudTrail 日志文件进行加密，然后在使用后尽快从内存中删除纯文本数据密钥。Amazon S3 将加密的数据密钥作为元数据存储在加密的 CloudTrail 日志文件中。

GenerateDataKey 请求包括加密上下文的以下信息：

每个GenerateDataKey请求都会在您的 CloudTrail 日志中生成一个条目，类似于以下示例。当你看到这样的日志条目时，你可以确定 CloudTrail ( Red circle with number 1 inside, indicating a numerical step or priority. ) 为特定跟踪 AWS KMS ( Red circle with number 2 inside, likely representing a step or item in a sequence. ) 调用了 ( Red circle with number 3 inside, indicating a step or sequence number. ) GenerateDataKey 操作 ( Red circle with number 4 inside, likely representing a notification or count indicator. )，以保护特定的日志文件 ( Red circle with white number 3 inside, indicating a step or sequence number. )。 AWS KMS 在指定的密钥 ( Red circle with white letter B inside, representing a logo or icon. ) 下创建了数据KMS密钥，在同一个日志条目中显示了两次。

注意

您可能需要滚动到右侧以查看以下示例日志条目中的某些标注。

{
  "eventVersion": "1.02",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROACKCEVSQ6C2EXAMPLE:i-34755b85",
    "arn": "arn:aws:sts::086441151436:assumed-role/AWSCloudTrail/i-34755b85",Red circle with number 1 inside, indicating a numerical step or priority.
    "accountId": "086441151436",
    "accessKeyId": "AKIAI44QH8DHBEXAMPLE",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2015-11-11T20:45:25Z"
      },
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROACKCEVSQ6C2EXAMPLE",
        "arn": "arn:aws:iam::086441151436:role/AWSCloudTrail",
        "accountId": "086441151436",
        "userName": "AWSCloudTrail"
      }
    },
    "invokedBy": "internal.amazonaws.com"
  },
  "eventTime": "2015-11-11T21:15:58Z",
  "eventSource": "kms.amazonaws.com",Red circle with number 2 inside, likely representing a step or item in a sequence.
  "eventName": "GenerateDataKey",Red circle with number 3 inside, indicating a step or sequence number.
  "awsRegion": "us-west-2",
  "sourceIPAddress": "internal.amazonaws.com",
  "userAgent": "internal.amazonaws.com",
  "requestParameters": {
    "encryptionContext": {
      "aws:cloudtrail:arn": "arn:aws:cloudtrail:us-west-2:111122223333:trail/Default",Red circle with number 4 inside, likely representing a notification or count indicator.
      "aws:s3:arn": "arn:aws:s3:::example-bucket-for-CT-logs/AWSLogs/111122223333/CloudTrail/us-west-2/2015/11/11/111122223333_CloudTrail_us-west-2_20151111T2115Z_7JREEBimdK8d2nC9.json.gz"Red circle with white number 3 inside, indicating a step or sequence number.
    },
    "keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",Red circle with white letter B inside, representing a logo or icon.
    "keySpec": "AES_256"
  },
  "responseElements": null,
  "requestID": "66f3f74a-88b9-11e5-b7fb-63d925c72ffe",
  "eventID": "7738554f-92ab-4e27-83e3-03354b1aa898",
  "readOnly": true,
  "resources": [{
    "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",Red circle with white letter B inside, representing a logo or icon.
    "accountId": "111122223333"
  }],
  "eventType": "AwsServiceEvent",
  "recipientAccountId": "111122223333"
}

从 S3 存储桶中获得加密的日志文件

每次您从 S3 存储桶获取加密的 CloudTrail 日志文件时，Amazon S3 都会代表您向发送解密该日志文件的加密数据密钥的Decrypt请求。 AWS KMS 为了响应此请求， AWS KMS 使用您的密KMS钥解密数据密钥，然后将纯文本数据密钥发送到 Amazon S3。Amazon S3 使用纯文本数据密钥解密 CloudTrail 日志文件，然后在使用后尽快从内存中删除纯文本数据密钥。

Decrypt 请求包括加密上下文的以下信息：

每个Decrypt请求都会在您的 CloudTrail 日志中生成一个条目，类似于以下示例。当你看到这样的日志条目时，你可以确定你的 AWS 账户 ( Red circle with number 1 inside, indicating a numerical step or priority. ) 中的用户为特定的跟踪 AWS KMS ( Red circle with number 2 inside, likely representing a step or item in a sequence. ) 和特定的日志文件 ( Red circle with number 4 inside, likely representing a notification or count indicator. ) 调用了 () Decrypt 操作 ( Red circle with white number 3 inside, indicating a step or sequence number. )。 Red circle with number 3 inside, indicating a step or sequence number. AWS KMS 已解密特定密钥下的数据密KMS钥 () Red circle with white letter B inside, representing a logo or icon. 。

注意

您可能需要滚动到右侧以查看以下示例日志条目中的某些标注。

{
  "eventVersion": "1.02",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDACKCEVSQ6C2EXAMPLE",
    "arn": "arn:aws:iam::111122223333:role/cloudtrail-admin",Red circle with number 1 inside, indicating a numerical step or priority.
    "accountId": "111122223333",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "userName": "cloudtrail-admin",
    "sessionContext": {"attributes": {
      "mfaAuthenticated": "false",
      "creationDate": "2015-11-11T20:48:04Z"
    }},
    "invokedBy": "signin.amazonaws.com"
  },
  "eventTime": "2015-11-11T21:20:52Z",
  "eventSource": "kms.amazonaws.com",Red circle with number 2 inside, likely representing a step or item in a sequence.
  "eventName": "Decrypt",Red circle with number 3 inside, indicating a step or sequence number.
  "awsRegion": "us-west-2",
  "sourceIPAddress": "internal.amazonaws.com",
  "userAgent": "internal.amazonaws.com",
  "requestParameters": {
    "encryptionContext": {
      "aws:cloudtrail:arn": "arn:aws:cloudtrail:us-west-2:111122223333:trail/Default",Red circle with number 4 inside, likely representing a notification or count indicator.
      "aws:s3:arn": "arn:aws:s3:::example-bucket-for-CT-logs/AWSLogs/111122223333/CloudTrail/us-west-2/2015/11/11/111122223333_CloudTrail_us-west-2_20151111T2115Z_7JREEBimdK8d2nC9.json.gz"Red circle with white number 3 inside, indicating a step or sequence number.
    }
  },
  "responseElements": null,
  "requestID": "16a0590a-88ba-11e5-b406-436f15c3ac01",
  "eventID": "9525bee7-5145-42b0-bed5-ab7196a16daa",
  "readOnly": true,
  "resources": [{
    "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",Red circle with white letter B inside, representing a logo or icon.
    "accountId": "111122223333"
  }],
  "eventType": "AwsApiCall",
  "recipientAccountId": "111122223333"
}