View a markdown version of this page

Configuring Amazon KMS keys for Amazon Web Services Support authorization - Amazon Web Services Support
Key requirementsHow Amazon Web Services Support authorization uses your Amazon KMS keyRequired key policy statementsRevoking Amazon Web Services Support authorization accessDisabling or deleting the keyMonitoring key usage
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Configuring Amazon KMS keys for Amazon Web Services Support authorization

Key requirements

A customer-managed Amazon KMS key is required for cryptographic signing of support permits. Your key must meet the following requirements:

  • Key spec: ECC_NIST_P384

  • Key usage: SIGN_VERIFY

  • The key must be in the same Amazon Region as the support permit.

Your private key material never leaves Amazon KMS. You create a grant on your key that allows it to call DescribeKey, GetPublicKey, and Sign. The grant is scoped to the support permit and retires when the support permit is deleted or deactivated.

How Amazon Web Services Support authorization uses your Amazon KMS key

When you create a support permit, your Amazon KMS key is used in the following way:

  1. Uses forward access sessions to call DescribeKey on your behalf, verifying that the key meets the required spec (ECC_NIST_P384) and usage (SIGN_VERIFY).

  2. Creates a grant on the key by calling CreateGrant on your behalf. The grant allows DescribeKey, GetPublicKey, and Sign operations.

  3. Verifies authorization when an Amazon Web Services Support request matches an existing support permit by using the grant to call Sign on the key. The resulting signature verifies that Amazon Web Services Support is authorized to perform the action.

Required key policy statements

Add the following policy statements to your Amazon KMS key policy. These are the minimum permissions required for Amazon Web Services Support authorization to use your key.

{
  "Sid": "Allows access to CreateGrant through SupportAuthZ",
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::111122223333:role/ExampleRole"},
  "Action": ["kms:CreateGrant"],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "supportauthz.us-east-1.amazonaws.com",
      "kms:GranteeServicePrincipal": "us-east-1.supportauthz.amazonaws.com",
      "kms:RetiringServicePrincipal": "us-east-1.supportauthz.amazonaws.com"
    },
    "ForAllValues:StringEquals": {
      "kms:GrantOperations": ["DescribeKey", "GetPublicKey", "Sign"]
    },
    "ArnLike": {
      "kms:GrantConstraintSourceArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermit/*"
    }
  }
},
{
  "Sid": "Allows access to DescribeKey through SupportAuthZ",
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::111122223333:role/ExampleRole"},
  "Action": ["kms:DescribeKey"],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "supportauthz.us-east-1.amazonaws.com"
    }
  }
}

These statements grant the following permissions:

CreateGrant

Allows the creation of grants for DescribeKey, GetPublicKey, and Sign operations. The conditions restrict grant creation to requests that are made through the Amazon Web Services Support authorization service and scoped to support permit resources in your account. Amazon Web Services Support authorization uses forward access sessions to call CreateGrant as part of creating a support permit.

DescribeKey

Allows verification that the key meets the required spec and usage type when you create a support permit using forward access sessions.

Note

Replace 111122223333 with your Amazon account ID and us-east-1 with the Amazon Region where you create your support permits.

Revoking Amazon Web Services Support authorization access

The recommended way to revoke signing permissions on your key is to revoke the grant. This prevents further signing operations without affecting other uses of the key.

To list and revoke grants for Amazon Web Services Support authorization:

  1. List grants on the key to find the grant ID:

    aws kms list-grants \
    --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

    Identify the grant by its name or the GrantConstraints source ARN that references your support permit.

  2. Revoke the grant:

    aws kms revoke-grant \
    --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
    --grant-id grant-id-from-list-grants

After you revoke the grant, new signed authorizations can no longer be issued for any support permit that uses this key. Because the Amazon KMS API follows an eventual consistency model, there might be a brief delay before the change is available throughout Amazon KMS.

Note

Revoking a grant doesn't delete the associated support permit. The support permit remains in ACTIVE state, but authorizations can't be signed for it. Grants are specific to each support permit. Creating a new support permit with the same Amazon KMS key doesn't restore Amazon Web Services Support authorization's ability to use the key for the original support permit.

Disabling or deleting the key

You can also disable or schedule deletion of the Amazon KMS key to prevent Amazon Web Services Support authorization from issuing signed authorizations. However, this affects all uses of the key, not just Amazon Web Services Support authorization.

Important

Both Amazon KMS and Amazon Web Services Support authorization are eventually consistent. After you disable or schedule deletion of a key, it can take up to several minutes for the change to take full effect. During this period, signed authorizations might continue to be issued by using the key. Grant revocation is also eventually consistent.

If you disable a key, then you can re-enable it in the Amazon KMS console or by calling EnableKey. If you delete a key, it can't be recovered.

Monitoring key usage

When your Amazon KMS key is used to sign an authorization, Amazon CloudTrail logs the signing operation in the key's event history. You can use these events to audit when and how often authorizations are signed on your behalf.