中的秘密加密和解密 Amazon Secrets Manager

Secrets Manager 调用该 Amazon KMS GenerateDataKey操作是为了响应以下 Secrets Manager 操作。

该RotateSecret操作不会调用GenerateDataKey，因为它不会更改密钥值。但是，如果 RotateSecret 调用更改了秘密值的 Lambda 轮换函数，则其调用 PutSecretValue 操作时将触发 GenerateDataKey 请求。

Secrets Manager 调用 Decrypt 操作来响应以下 Secrets Manager 操作。

Secrets Manager 调用 Encrypt 操作来响应以下 Secrets Manager 操作：

当你在 Secrets Manager 控制台中创建或编辑密钥时，Secrets Manager 调用该DescribeKey操作来确定是列出 KMS 密钥。

当您建立或更改与密钥关联的 KMS 密钥时，Secrets Manager 将用指定的 KMS 调用 GenerateDataKey 和 Decrypt 操作。这些调用确认调用方是否有权将该 KMS 密钥用于这些操作。Secrets Manager 将放弃这些操作的结果；它不在任何加密操作中使用这些结果。

您可以识别这些验证调用，因为这些请求中 SecretVersionId 密钥加密上下文的值为 RequestToValidateKeyAccess。

当您在密钥中创建或更改密钥值时，Secrets Manager 会向发送一个GenerateDataKey请求 Amazon KMS ，为该密钥指定 KMS 密钥。

记录 GenerateDataKey 操作的事件与以下示例事件类似。该请求由 secretsmanager.amazonaws.com 调用。参数包括密钥的 KMS 密钥的 Amazon Resource Name (ARN)、需要 256 位密钥的密钥说明符以及标识密钥和版本的加密上下文。

{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AROAIGDTESTANDEXAMPLE:user01",
        "arn": "arn:aws:sts::111122223333:assumed-role/Admin/user01",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "sessionContext": {
            "attributes": {
                "mfaAuthenticated": "false",
                "creationDate": "2018-05-31T23:23:41Z"
            }
        },
        "invokedBy": "secretsmanager.amazonaws.com"
    },
    "eventTime": "2018-05-31T23:23:41Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "GenerateDataKey",
    "awsRegion": "us-east-2",
    "sourceIPAddress": "secretsmanager.amazonaws.com",
    "userAgent": "secretsmanager.amazonaws.com",
    "requestParameters": {
        "keyId": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
        "keySpec": "AES_256",
        "encryptionContext": {
            "SecretARN": "arn:aws:secretsmanager:us-east-2:111122223333:secret:test-secret-a1b2c3",
            "SecretVersionId": "EXAMPLE1-90ab-cdef-fedc-ba987SECRET1"
        }
    },
    "responseElements": null,
    "requestID": "a7d4dd6f-6529-11e8-9881-67744a270888",
    "eventID": "af7476b6-62d7-42c2-bc02-5ce86c21ed36",
    "readOnly": true,
    "resources": [
        {
            "ARN": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "accountId": "111122223333",
            "type": "AWS::KMS::Key"
        }
    ],
    "eventType": "AwsApiCall",
    "recipientAccountId": "111122223333"
}

当您获取或更改密钥的密钥值时，Secrets Manager 会向发送解密请求 Amazon KMS 以解密加密的数据密钥。对于批处理命令，Secrets Manager 可以重复使用解密后的密钥，因此并非所有调用都会产生 Decrypt 请求。

记录 Decrypt 操作的事件与以下示例事件类似。用户是您 Amazon 账户中访问表格的委托人。这些参数包括加密的表密钥（作为密文 blob）以及标识表和账户的加密上下文。 Amazon Amazon KMS 从密文中获取 KMS 密钥的 ID。

{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AROAIGDTESTANDEXAMPLE:user01",
        "arn": "arn:aws:sts::111122223333:assumed-role/Admin/user01",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "sessionContext": {
            "attributes": {
                "mfaAuthenticated": "false",
                "creationDate": "2018-05-31T23:36:09Z"
            }
        },
        "invokedBy": "secretsmanager.amazonaws.com"
    },
    "eventTime": "2018-05-31T23:36:09Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "Decrypt",
    "awsRegion": "us-east-2",
    "sourceIPAddress": "secretsmanager.amazonaws.com",
    "userAgent": "secretsmanager.amazonaws.com",
    "requestParameters": {
        "encryptionContext": {
            "SecretARN": "arn:aws:secretsmanager:us-east-2:111122223333:secret:test-secret-a1b2c3",
            "SecretVersionId": "EXAMPLE1-90ab-cdef-fedc-ba987SECRET1"
        }
    },
    "responseElements": null,
    "requestID": "658c6a08-652b-11e8-a6d4-ffee2046048a",
    "eventID": "f333ec5c-7fc1-46b1-b985-cbda13719611",
    "readOnly": true,
    "resources": [
        {
            "ARN": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "accountId": "111122223333",
            "type": "AWS::KMS::Key"
        }
    ],
    "eventType": "AwsApiCall",
    "recipientAccountId": "111122223333"
}

当您更改与密钥关联的 KMS 密钥时，Secrets Manager 会向发送加密请求，要求使用新密钥重新加AWSPENDING密AWSCURRENTAWSPREVIOUS、和密钥版本。 Amazon KMS 当您将密钥复制到另一个区域时，Secrets Manager 还会向  Amazon KMS 发送 Encrypt 请求。

记录 Encrypt 操作的事件与以下示例事件类似。用户是您 Amazon 账户中访问表格的委托人。

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AROAIGDTESTANDEXAMPLE:user01",
        "arn": "arn:aws:sts::111122223333:assumed-role/Admin/user01",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "sessionContext": {
            "attributes": {
                "creationDate": "2023-06-09T18:11:34Z",
                "mfaAuthenticated": "false"
            }
        },
        "invokedBy": "secretsmanager.amazonaws.com"
    },
    "eventTime": "2023-06-09T18:11:34Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "Encrypt",
    "awsRegion": "us-east-2",
    "sourceIPAddress": "secretsmanager.amazonaws.com",
    "userAgent": "secretsmanager.amazonaws.com",
    "requestParameters": {
        "keyId": "arn:aws:kms:us-east-2:111122223333:key/EXAMPLE1-f1c8-4dce-8777-aa071ddefdcc",
        "encryptionAlgorithm": "SYMMETRIC_DEFAULT",
        "encryptionContext": {
            "SecretARN": "arn:aws:secretsmanager:us-east-2:111122223333:secret:ChangeKeyTest-5yKnKS",
            "SecretVersionId": "EXAMPLE1-5c55-4d7c-9277-1b79a5e8bc50"
        }
    },
    "responseElements": null,
    "requestID": "129bd54c-1975-4c00-9b03-f79f90e61d60",
    "eventID": "f7d9ff39-15ab-47d8-b94c-56586de4ab68",
    "readOnly": true,
    "resources": [
        {
            "accountId": "AWS Internal",
            "type": "AWS::KMS::Key",
            "ARN": "arn:aws:kms:us-west-2:111122223333:key/EXAMPLE1-f1c8-4dce-8777-aa071ddefdcc"
        }
    ],
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "eventCategory": "Management"
}