UpdatePrimaryRegion - Amazon Key Management Service
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 Amazon Web Services 服务入门

UpdatePrimaryRegion

以下示例显示了通过对多区域密钥调用 UpdatePrimaryRegion 操作生成的 Amazon CloudTrail 日志条目。

UpdatePrimaryRegion 操作将写入两个 CloudTrail 日志条目:一个位于具有多区域主密钥的区域中,被转换为副本密钥,一个位于具有多区域副本密钥的区域中,被转换为主密钥。

下面的示例显示了多区域密钥从主密钥更改为副本密钥所在区域 (us-west-2) 中的 UpdatePrimaryRegion 的 CloudTrail 日志条目。primaryRegion 字段显示了现在托管主密钥的区域 (ap-northeast-1)。

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice" }, "eventTime": "2021-03-10T20:23:37Z", "eventSource": "kms.amazonaws.com", "eventName": "UpdatePrimaryRegion", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.0", "userAgent": "AWS Internal", "requestParameters": { "keyId": "mrk-1234abcd12ab34cd56ef1234567890ab", "primaryRegion": "ap-northeast-1" }, "responseElements": null, "requestID": "ee408f36-ea01-422b-ac14-b0f147c68334", "eventID": "3c4226b0-1e81-48a8-a333-7fa5f3cbd118", "readOnly": false, "resources": [ { "accountId": "111122223333", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab" } ], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111122223333" }

下面的示例代表了多区域密钥从副本密钥更改为主密钥所在区域 (ap-northeast-1) 中的 UpdatePrimaryRegion 的 CloudTrail 日志条目。此日志条目没有标识以前的主要区域。

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "invokedBy": "kms.amazonaws.com" }, "eventTime": "2021-03-10T20:23:37Z", "eventSource": "kms.amazonaws.com", "eventName": "UpdatePrimaryRegion", "awsRegion": "ap-northeast-1", "sourceIPAddress": "192.0.2.0", "userAgent": "AWS Internal", "requestParameters": { "keyId": "arn:aws:kms:ap-northeast-1:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab", "primaryRegion": "ap-northeast-1" }, "responseElements": null, "requestID": "ee408f36-ea01-422b-ac14-b0f147c68334", "eventID": "091e6be5-737f-43c6-8431-e3679d6d0619", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111122223333" }