如何 AWS CloudTrail 使用 AWS KMS - AWS Key Management Service
了解何時使用您的KMS金鑰

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

如何 AWS CloudTrail 使用 AWS KMS

您可以用 AWS CloudTrail 來記錄 AWS API呼叫和其他活動， AWS 帳戶 並將記錄的資訊儲存到您選擇的 Amazon Simple Storage Service (Amazon S3) 儲存貯體中的日誌檔案。根據預設， CloudTrail 放入 S3 儲存貯體的日誌檔會使用伺服器端加密搭配 Amazon S3 受管加密金鑰 (SSE-S3) 進行加密。但是您可以選擇使用帶有密KMS鑰（SSE-KMS）的服務器端加密。若要瞭解如何使用加密 CloudTrail 記錄檔案 AWS KMS，請參閱AWS CloudTrail 使用指南中的使用 AWS KMS keys (SSE-KMS) 加密 CloudTrail 記錄檔。

重要

AWS CloudTrail 和 Amazon S3 僅支持對稱 AWS KMS keys。您無法使用非對稱KMS金鑰來加密 CloudTrail 記錄。如需判斷KMS金鑰是對稱還是非對稱的說明，請參閱識別非對稱 KMS 金鑰。

CloudTrail 讀取或寫入使用-金鑰加密的記錄檔時，您不需要支付SSE金KMS鑰使用費。不過，當您存取使用-金鑰加密的 CloudTrail 記錄檔時，需要支付SSE金KMS鑰使用費。如需 AWS KMS 定價的相關資訊，請參閱AWS Key Management Service 定價。如需有關 CloudTrail 定價的資訊，請參閱AWS CloudTrail 使用者指南中的AWS CloudTrail 定價和管理成本。

了解何時使用您的KMS金鑰

使用 Amazon S3 上的 AWS KMS 建置功能加密 CloudTrail 日誌檔，稱為伺服器端加密，並使用 AWS KMS key (SSE-KMS)。若要進一步了解 SSE-KMS，請參閱Amazon Simple Storage Service (Amazon S3) 如何使用 AWS KMS本指南或 Amazon 簡單儲存服務使用者指南中的使用伺服器端加密使用KMS金鑰 (SSE-KMS) 保護資料。

當您設定 AWS CloudTrail 為使用 SSE-KMS 加密您的日誌檔時， CloudTrail Amazon S3 會在您使用這些服務執行特定動作 AWS KMS keys 時使用您的。以下各節說明這些服務何時以及如何使用您的KMS金鑰，並提供可用來驗證此說明的其他資訊。

您配置使 CloudTrail 用您的加密日誌文件 AWS KMS key

當您更新 CloudTrail組態以使用KMS金鑰時， CloudTrail 會傳送GenerateDataKey AWS KMS 要求以確認KMS金鑰是否存在，以及 CloudTrail 具有將其用於加密的權限。 CloudTrail 不使用產生的資料金鑰。

GenerateDataKey 請求包含加密內容的下列資訊：

要GenerateDataKey求會在 CloudTrail 記錄檔中產生類似下列範例的項目。當您看到類似這樣的記錄項目時，您可以判斷 CloudTrail ( Red circle with number 1 inside, indicating a numerical step or priority. ) 呼叫 AWS KMS ( Red circle with number 2 inside, likely representing a step or item in a sequence. ) GenerateDataKey 操作 ( Red circle with number 3 inside, indicating a step or sequence number. ) 的特定追蹤 ( Red circle with number 4 inside, likely representing a notification or count indicator. )。 AWS KMS 在特定鍵 ( Red circle with white number 3 inside, indicating a step or sequence number. ) 下創建了數據KMS鍵。

注意

您可能需要捲動至右側，才能看見下列範例日誌項目中的一些圖說文字。

{
  "eventVersion": "1.02",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDACKCEVSQ6C2EXAMPLE",
    "arn": "arn:aws:iam::086441151436:user/AWSCloudTrail",Red circle with number 1 inside, indicating a numerical step or priority.
    "accountId": "086441151436",
    "accessKeyId": "AKIAI44QH8DHBEXAMPLE",
    "userName": "AWSCloudTrail",
    "sessionContext": {"attributes": {
      "mfaAuthenticated": "false",
      "creationDate": "2015-11-11T21:15:33Z"
    }},
    "invokedBy": "internal.amazonaws.com"
  },
  "eventTime": "2015-11-11T21:15:33Z",
  "eventSource": "kms.amazonaws.com",Red circle with number 2 inside, likely representing a step or item in a sequence.
  "eventName": "GenerateDataKey",Red circle with number 3 inside, indicating a step or sequence number.
  "awsRegion": "us-west-2",
  "sourceIPAddress": "internal.amazonaws.com",
  "userAgent": "internal.amazonaws.com",
  "requestParameters": {
    "keyId": "arn:aws:kms:us-west-2:111122223333:alias/ExampleAliasForCloudTrailKMS key",
    "encryptionContext": {
      "aws:cloudtrail:arn": "arn:aws:cloudtrail:us-west-2:111122223333:trail/Default",Red circle with number 4 inside, likely representing a notification or count indicator.
      "aws:s3:arn": "arn:aws:s3:::example-bucket-for-CT-logs/AWSLogs/111122223333/"
    },
    "keySpec": "AES_256"
  },
  "responseElements": null,
  "requestID": "581f1f11-88b9-11e5-9c9c-595a1fb59ac0",
  "eventID": "3cdb2457-c035-4890-93b6-181832b9e766",
  "readOnly": true,
  "resources": [{
    "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",Red circle with white number 3 inside, indicating a step or sequence number.
    "accountId": "111122223333"
  }],
  "eventType": "AwsServiceEvent",
  "recipientAccountId": "111122223333"
}

CloudTrail 將日誌文件放入您的 S3 存儲桶

每次將日誌檔 CloudTrail 放入 S3 儲存貯體時，Amazon S3 都會代表向 AWS KMS 其傳送GenerateDataKey請求 CloudTrail。為了回應此請求， AWS KMS 會產生唯一的資料金鑰，然後傳送兩個資料金鑰副本，一個是純文字，另一個使用指定KMS金鑰加密。Amazon S3 使用純文字資料金鑰加密 CloudTrail 日誌檔，然後在使用後儘快從記憶體中移除純文字資料金鑰。Amazon S3 會將加密的資料金鑰存放為中繼資料，其中包含加密的 CloudTrail 日誌檔。

GenerateDataKey 請求包含加密內容的下列資訊：

每個GenerateDataKey要求都會在 CloudTrail 記錄檔中產生一個項目，類似於下列範例。當您看到類似這樣的記錄項目時，您可以針對特定的追蹤 AWS KMS ( Red circle with number 2 inside, likely representing a step or item in a sequence. ) 判斷 ( Red circle with number 3 inside, indicating a step or sequence number. ) 呼叫 () GenerateDataKey 操作 ( Red circle with number 4 inside, likely representing a notification or count indicator. )，以保護特定的記錄檔 ( Red circle with white number 3 inside, indicating a step or sequence number. )。 CloudTrail Red circle with number 1 inside, indicating a numerical step or priority. AWS KMS 在指定的 key ( Red circle with white letter B inside, representing a logo or icon. ) 下創建了數據KMS鍵，在同一個日誌條目中顯示兩次。

注意

您可能需要捲動至右側，才能看見下列範例日誌項目中的一些圖說文字。

{
  "eventVersion": "1.02",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROACKCEVSQ6C2EXAMPLE:i-34755b85",
    "arn": "arn:aws:sts::086441151436:assumed-role/AWSCloudTrail/i-34755b85",Red circle with number 1 inside, indicating a numerical step or priority.
    "accountId": "086441151436",
    "accessKeyId": "AKIAI44QH8DHBEXAMPLE",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2015-11-11T20:45:25Z"
      },
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROACKCEVSQ6C2EXAMPLE",
        "arn": "arn:aws:iam::086441151436:role/AWSCloudTrail",
        "accountId": "086441151436",
        "userName": "AWSCloudTrail"
      }
    },
    "invokedBy": "internal.amazonaws.com"
  },
  "eventTime": "2015-11-11T21:15:58Z",
  "eventSource": "kms.amazonaws.com",Red circle with number 2 inside, likely representing a step or item in a sequence.
  "eventName": "GenerateDataKey",Red circle with number 3 inside, indicating a step or sequence number.
  "awsRegion": "us-west-2",
  "sourceIPAddress": "internal.amazonaws.com",
  "userAgent": "internal.amazonaws.com",
  "requestParameters": {
    "encryptionContext": {
      "aws:cloudtrail:arn": "arn:aws:cloudtrail:us-west-2:111122223333:trail/Default",Red circle with number 4 inside, likely representing a notification or count indicator.
      "aws:s3:arn": "arn:aws:s3:::example-bucket-for-CT-logs/AWSLogs/111122223333/CloudTrail/us-west-2/2015/11/11/111122223333_CloudTrail_us-west-2_20151111T2115Z_7JREEBimdK8d2nC9.json.gz"Red circle with white number 3 inside, indicating a step or sequence number.
    },
    "keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",Red circle with white letter B inside, representing a logo or icon.
    "keySpec": "AES_256"
  },
  "responseElements": null,
  "requestID": "66f3f74a-88b9-11e5-b7fb-63d925c72ffe",
  "eventID": "7738554f-92ab-4e27-83e3-03354b1aa898",
  "readOnly": true,
  "resources": [{
    "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",Red circle with white letter B inside, representing a logo or icon.
    "accountId": "111122223333"
  }],
  "eventType": "AwsServiceEvent",
  "recipientAccountId": "111122223333"
}

您從 S3 儲存貯體取得加密的日誌檔

每次您從 S3 儲存貯體取得加密的 CloudTrail 日誌檔時，Amazon S3 都會代表您傳送Decrypt請求，以解密日誌檔的加密資料金鑰。 AWS KMS 回應此請求時， AWS KMS 使用您的KMS金鑰解密資料金鑰，然後將純文字資料金鑰傳送到 Amazon S3。Amazon S3 使用純文字資料金鑰解密 CloudTrail 日誌檔，然後在使用後儘快從記憶體中移除純文字資料金鑰。

Decrypt 請求包含加密內容的下列資訊：

每個Decrypt要求都會在 CloudTrail 記錄檔中產生一個項目，類似於下列範例。當您看到類似這樣的記錄項目時，您可以判斷 AWS 帳戶 ( Red circle with number 1 inside, indicating a numerical step or priority. ) 中的使用者稱為特定的 Trail AWS KMS ( Red circle with number 2 inside, likely representing a step or item in a sequence. Red circle with number 3 inside, indicating a step or sequence number. ) Decrypt 操作 ( Red circle with number 4 inside, likely representing a notification or count indicator. ) 和特定的記錄檔 ( Red circle with white number 3 inside, indicating a step or sequence number. )。 AWS KMS 解密特定鍵 ( Red circle with white letter B inside, representing a logo or icon. ) 下的資料KMS金鑰。

注意

您可能需要捲動至右側，才能看見下列範例日誌項目中的一些圖說文字。

{
  "eventVersion": "1.02",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDACKCEVSQ6C2EXAMPLE",
    "arn": "arn:aws:iam::111122223333:role/cloudtrail-admin",Red circle with number 1 inside, indicating a numerical step or priority.
    "accountId": "111122223333",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "userName": "cloudtrail-admin",
    "sessionContext": {"attributes": {
      "mfaAuthenticated": "false",
      "creationDate": "2015-11-11T20:48:04Z"
    }},
    "invokedBy": "signin.amazonaws.com"
  },
  "eventTime": "2015-11-11T21:20:52Z",
  "eventSource": "kms.amazonaws.com",Red circle with number 2 inside, likely representing a step or item in a sequence.
  "eventName": "Decrypt",Red circle with number 3 inside, indicating a step or sequence number.
  "awsRegion": "us-west-2",
  "sourceIPAddress": "internal.amazonaws.com",
  "userAgent": "internal.amazonaws.com",
  "requestParameters": {
    "encryptionContext": {
      "aws:cloudtrail:arn": "arn:aws:cloudtrail:us-west-2:111122223333:trail/Default",Red circle with number 4 inside, likely representing a notification or count indicator.
      "aws:s3:arn": "arn:aws:s3:::example-bucket-for-CT-logs/AWSLogs/111122223333/CloudTrail/us-west-2/2015/11/11/111122223333_CloudTrail_us-west-2_20151111T2115Z_7JREEBimdK8d2nC9.json.gz"Red circle with white number 3 inside, indicating a step or sequence number.
    }
  },
  "responseElements": null,
  "requestID": "16a0590a-88ba-11e5-b406-436f15c3ac01",
  "eventID": "9525bee7-5145-42b0-bed5-ab7196a16daa",
  "readOnly": true,
  "resources": [{
    "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",Red circle with white letter B inside, representing a logo or icon.
    "accountId": "111122223333"
  }],
  "eventType": "AwsApiCall",
  "recipientAccountId": "111122223333"
}