Create an encryption key for Fargate ephemeral storage for Amazon ECS

Navigate to the https://console.amazonaws.cn/kms.

Follow the instructions for Creating Keys in the Amazon Key Management Service Developer Guide.

When creating your Amazon KMS key, make sure to provide Fargate service relevant Amazon KMS operation permissions in the key policies. The following API operations must be permitted in the policy to use your customer managed key with your Amazon ECS cluster resources.

The following example shows a Amazon KMS key policy that you would apply to the target key for encryption. To use the example policy statements, replace the user input placeholders with your own information. As always, only configure the permissions that you need, but you'll need to provide Amazon KMS with permissions to at least one user to avoid errors.

{
      "Sid": "Allow generate data key access for Fargate tasks.",
      "Effect": "Allow",
      "Principal": { "Service":"fargate.amazonaws.com" },
      "Action": [
        "kms:GenerateDataKeyWithoutPlaintext"
      ],
      "Condition": {
        "StringEquals": {
          "kms:EncryptionContext:aws:ecs:clusterAccount": [
            "customerAccountId"
          ],
          "kms:EncryptionContext:aws:ecs:clusterName": [
             "clusterName"
          ]   
        }
      },
      "Resource": "*"
    },
    {
      "Sid": "Allow grant creation permission for Fargate tasks.",
      "Effect": "Allow",
      "Principal": { "Service":"fargate.amazonaws.com" },
      "Action": [
        "kms:CreateGrant"
      ],
      "Condition": {
        "StringEquals": {
          "kms:EncryptionContext:aws:ecs:clusterAccount": [
            "customerAccountId"
          ],
          "kms:EncryptionContext:aws:ecs:clusterName": [
             "clusterName"
          ]   
        },
       "ForAllValues:StringEquals": {
          "kms:GrantOperations": [
             "Decrypt"
          ]
       }
      },
      "Resource": "*"
    },
    {
      "Sid": "Allow describe key permission for cluster operator - CreateCluster and UpdateCluster.",
      "Effect": "Allow",
      "Principal": { "AWS":"arn:aws:iam::customerAccountId:role/customer-chosen-role" },
      "Action": [
        "kms:DescribeKey"
      ],
      "Resource": "*"
    }

Fargate tasks use the aws:ecs:clusterAccount and aws:ecs:clusterName encryption context keys for cryptographic operations with the key. Customers should add these permissions to restrict access to a specific account and/or cluster. Use the cluster name and not the ARN when you specify the cluster.

For more information, see Encryption context in the Amazon KMS Developer Guide.

When creating or updating a cluster, you have the option to use the condition key fargateEphemeralStorageKmsKeyId. This condition key allows customers to have more granular control of the IAM policies. Updates to the fargateEphemeralStorageKmsKeyId configuration only take effect on new service deployments.

The following is an example of allowing customers to grant permissions to only a specific set of approved Amazon KMS keys.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:CreateCluster",
        "ecs:UpdateCluster"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ecs:fargate-ephemeral-storage-kms-key": "arn:aws:kms:us-west-2:111122223333:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
        }
      }
    }
  ]
}

Next is an example for denying attempts to remove Amazon KMS keys that are already associated with a cluster.

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Deny",
    "Action": [
        "ecs:CreateCluster",
        "ecs:UpdateCluster"
    ],
    "Resource": "*",
    "Condition": {
      "Null": {
        "ecs:fargate-ephemeral-storage-kms-key": "true"
      }
    }
  }
}

Customers can see if their unmanaged tasks or service tasks are encrypted using the key by using the Amazon CLI describe-tasks, describe-cluster, or describe-services commands.

For more information, see Condition keys for Amazon KMS in the Amazon KMS Developer Guide.