Amazon Secrets Manager 中的密钥加密和解密

Secrets Manager 调用 Amazon KMS GenerateDataKey 操作来响应以下 Secrets Manager 操作。

为对加密的密钥值解密，Secrets Manager 将调用 Amazon KMS Decrypt 操作，来对密钥中的已加密数据密钥解密。然后，它使用明文数据密钥来对已加密密钥值解密。

Secrets Manager 调用 Decrypt 操作来响应以下 Secrets Manager 操作。

当您建立或更改与密钥关联的 KMS 密钥时，Secrets Manager 将用指定的 KMS 调用 GenerateDataKey 和 Decrypt 操作。这些调用确认调用方是否有权将该 KMS 密钥用于这些操作。Secrets Manager 将放弃这些操作的结果；它不在任何加密操作中使用这些结果。

您可以识别这些验证调用，因为这些请求中 SecretVersionId 密钥加密上下文的值为 RequestToValidateKeyAccess。

当您在密钥中创建或更改密钥值时，Secrets Manager 将向 Amazon KMS 发送 GenerateDataKey 请求，为密钥指定 KMS 密钥。

记录 GenerateDataKey 操作的事件与以下示例事件类似。该请求由 secretsmanager.amazonaws.com 调用。参数包括密钥的 KMS 密钥的 Amazon Resource Name (ARN)、需要 256 位密钥的密钥说明符以及标识密钥和版本的加密上下文。

{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AROAIGDTESTANDEXAMPLE:user01",
        "arn": "arn:aws:sts::111122223333:assumed-role/Admin/user01",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "sessionContext": {
            "attributes": {
                "mfaAuthenticated": "false",
                "creationDate": "2018-05-31T23:23:41Z"
            }
        },
        "invokedBy": "secretsmanager.amazonaws.com"
    },
    "eventTime": "2018-05-31T23:23:41Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "GenerateDataKey",
    "awsRegion": "us-east-2",
    "sourceIPAddress": "secretsmanager.amazonaws.com",
    "userAgent": "secretsmanager.amazonaws.com",
    "requestParameters": {
        "keyId": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
        "keySpec": "AES_256",
        "encryptionContext": {
            "SecretARN": "arn:aws:secretsmanager:us-east-2:111122223333:secret:test-secret-a1b2c3",
            "SecretVersionId": "EXAMPLE1-90ab-cdef-fedc-ba987SECRET1"
        }
    },
    "responseElements": null,
    "requestID": "a7d4dd6f-6529-11e8-9881-67744a270888",
    "eventID": "af7476b6-62d7-42c2-bc02-5ce86c21ed36",
    "readOnly": true,
    "resources": [
        {
            "ARN": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "accountId": "111122223333",
            "type": "AWS::KMS::Key"
        }
    ],
    "eventType": "AwsApiCall",
    "recipientAccountId": "111122223333"
}

每当您获取或更改密钥的密钥值时，Secrets Manager 都会向 Amazon KMS 发送 Decrypt 请求，以对已加密数据密钥进行解密。

记录 Decrypt 操作的事件与以下示例事件类似。用户是您的 Amazon 账户中正在访问表的委托人。参数包括加密表密钥（作为密文 blob）以及标识表和 Amazon 账户的加密上下文。Amazon KMS 从密文得出 KMS 密钥 ID。

{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AROAIGDTESTANDEXAMPLE:user01",
        "arn": "arn:aws:sts::111122223333:assumed-role/Admin/user01",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "sessionContext": {
            "attributes": {
                "mfaAuthenticated": "false",
                "creationDate": "2018-05-31T23:36:09Z"
            }
        },
        "invokedBy": "secretsmanager.amazonaws.com"
    },
    "eventTime": "2018-05-31T23:36:09Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "Decrypt",
    "awsRegion": "us-east-2",
    "sourceIPAddress": "secretsmanager.amazonaws.com",
    "userAgent": "secretsmanager.amazonaws.com",
    "requestParameters": {
        "encryptionContext": {
            "SecretARN": "arn:aws:secretsmanager:us-east-2:111122223333:secret:test-secret-a1b2c3",
            "SecretVersionId": "EXAMPLE1-90ab-cdef-fedc-ba987SECRET1"
        }
    },
    "responseElements": null,
    "requestID": "658c6a08-652b-11e8-a6d4-ffee2046048a",
    "eventID": "f333ec5c-7fc1-46b1-b985-cbda13719611",
    "readOnly": true,
    "resources": [
        {
            "ARN": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "accountId": "111122223333",
            "type": "AWS::KMS::Key"
        }
    ],
    "eventType": "AwsApiCall",
    "recipientAccountId": "111122223333"
}