Amazon EC2 示例之一 - AWS Key Management Service
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

Amazon EC2 示例之一

以下示例显示了 IAM 用户如何在 Amazon EC2 管理控制台中使用默认卷密钥创建加密卷。

以下示例显示了一个 CloudTrail 日志条目,该日志条目演示了用户 Alice 如何在 Amazon EC2 管理控制台中使用默认卷密钥创建加密卷。该 EC2 日志文件记录包含一个 volumeId 字段,其值为 "vol-13439757"。AWS KMS 记录包含encryptionContext字段中的值为"aws:ebs:id": "vol-13439757"。同样,这两个记录的 principalIdaccountId 都相互匹配。这些记录反映了一个事实,即创建加密卷生成的数据密钥被用于加密卷内容。

{ "Records": [ { "eventVersion": "1.02", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "sessionContext": { "attributes": { "mfaAuthenticated": "false", "creationDate": "2014-11-05T20:40:44Z" } }, "invokedBy": "signin.amazonaws.com" }, "eventTime": "2014-11-05T20:50:18Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateVolume", "awsRegion": "us-east-1", "sourceIPAddress": "72.72.72.72", "userAgent": "signin.amazonaws.com", "requestParameters": { "size": "10", "zone": "us-east-1a", "volumeType": "gp2", "encrypted": true }, "responseElements": { "volumeId": "vol-13439757", "size": "10", "zone": "us-east-1a", "status": "creating", "createTime": 1415220618876, "volumeType": "gp2", "iops": 30, "encrypted": true }, "requestID": "1565210e-73d0-4912-854c-b15ed349e526", "eventID": "a3447186-135f-4b00-8424-bc41f1a93b4f", "eventType": "AwsApiCall", "recipientAccountId": "123456789012" }, { "eventVersion": "1.02", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "sessionContext": { "attributes": { "mfaAuthenticated": "false", "creationDate": "2014-11-05T20:40:44Z" } }, "invokedBy": "AWS Internal" }, "eventTime": "2014-11-05T20:50:19Z", "eventSource": "kms.amazonaws.com", "eventName": "GenerateDataKeyWithoutPlaintext", "awsRegion": "us-east-1", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": { "encryptionContext": { "aws:ebs:id": "vol-13439757" }, "numberOfBytes": 64, "keyId": "alias/aws/ebs" }, "responseElements": null, "requestID": "create-123456789012-758241111-1415220618", "eventID": "4bd2a696-d833-48cc-b72c-05e61b608399", "readOnly": true, "resources": [ { "ARN": "arn:aws:kms:us-east-1:123456789012:key/e29ddfd4-1bf6-4e1b-8ecb-08216bd70d07", "accountId": "123456789012" } ], "eventType": "AwsApiCall", "recipientAccountId": "123456789012" } ] }