Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

AWS Resources

Managing AWS Accounts

search

Please Note:

Managing AWS Accounts

This section describes how to manage AWS accounts on the CCKM.

Before proceeding, make sure to fulfill prerequisites.

Adding AWS Accounts

CCKM allows adding same AWS account in one CipherTrust Manager domain with different names, with each entry having a unique set of regions. By default, only the KMSs linked with the AWS account that is used for connection with the CipherTrust Manager can be added. However, if you want, you can assume a role within the same or a different account, while adding KMS over the same connection.

To add an AWS account to the CCKM:

  1. Log on to the CipherTrust Manager GUI as administrator.

  2. Open the Cloud Key Manager application.

  3. In the left pane, click Containers > AWS KMS Accounts. The AWS KMS Accounts page is displayed.

  4. Click Add Account. The Add AWS Account screen is displayed.

  5. Select/enter the following details:

    1. Specify a unique Name.

    2. From the AWS Connection drop-down list, select the desired connection.

      The AWS Account ID and Available regions of the selected AWS connection are displayed.

    3. In the Available regions section, select the desired regions.

      By default, all the regions are selected. You can also use the Search box to filter the regions.

      If you select a subset of available regions, then the remaining regions can be added under a different AWS KMS account name but under the same AWS Account ID.

    4. Click the right arrow button (Right Arrow). The selected regions move to the Selected regions list.

  6. Click Save. The AWS account is added to the CCKM.

Adding AWS KMS Account and Regions by AssumeRole

CCKM allows adding same AWS account in one CipherTrust Manager domain with different names, with each entry having a unique set of regions. By default, only the KMSs linked with the AWS account that is used for connection with the CipherTrust Manager can be added. However, if you want, you can assume a role within the same or a different account, while adding KMS over the same connection. To do this, you need to specify the ARN and/or external ID of the role to be assumed.

Note

An AssumeRole provides a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to. Refer to AWS documentation for details on AWS AssumeRole.

Tip

To configure AWS accounts for AssumeRole, refer to IAM tutorial: Delegate access across AWS accounts using IAM roles.

To add an AWS account and regions by AssumeRole:

  1. Log on to the CipherTrust Manager GUI as administrator.

  2. Open the Cloud Key Manager application.

  3. In the left pane, click Containers > AWS KMS Accounts. The AWS KMS Accounts page is displayed.

  4. Click Add Account. The Add AWS Account screen is displayed.

  5. Select/enter the following details:

    1. Specify a unique Name.

    2. From the AWS Connection drop-down list, select the desired connection.

      The AWS Account ID and Available regions of the selected AWS connection are displayed.

    3. Specify the AssumeRole details:

      1. Select Add Assumed Role. The following fields are displayed:

        • Assume Role: Specify the Amazon Resource Name (ARN) of the role to be assumed. This is a mandatory field.

        • Assume Role External ID: Specify the external ID for the role to be assumed.

      2. Click Test Connection. When the connection is successful, the AWS Account ID associated with the assumed role is displayed. The Available regions section is populated with the available regions.

    4. In the Available regions section, select the desired regions.

      By default, all the regions are selected. You can also use the Search box to filter the regions.

      If you select a subset of available regions, then the remaining regions can be added under a different AWS KMS account name but under the same AWS Account ID.

    5. Click the right arrow button (Right Arrow). The selected regions move to the Selected regions list.

  6. Click Save. The AWS account is added to the CCKM.

Refreshing AWS Accounts

Refreshing is the process to download keys created on the AWS KMS to the CCKM. You can refresh keys from individual or all KMS accounts.

Refreshing Specific AWS Accounts

To refresh an AWS account:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Containers > AWS KMS Accounts. The AWS KMS Accounts page is displayed. This page displays the list of AWS accounts.

  3. Click the overflow icon (ellipsis) corresponding to the desired AWS account and click Refresh Now.

  4. On the Refresh Now screen, select the desired account regions to be refreshed.

  5. Click Refresh.

A message Refresh started... is displayed on the screen. To cancel the refresh, click Cancel Refresh.

The refreshed keys are listed on the Cloud Keys > AWS > AWS Keys page. Refer to Viewing AWS Keys for details.

Refreshing All AWS Accounts

To refresh all AWS accounts:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Containers > AWS KMS Accounts. The AWS KMS Accounts page is displayed. This page displays the list of AWS accounts.

  3. Click Refresh All.

    Note

    Refresh all KMS Accounts is a time intensive operation that could take several hours or days to complete. It will continue running in the background. Do you want to continue?

  4. Click Refresh All.

A message Refresh started... is displayed on the screen. To cancel the refresh, click Cancel Refresh.

The refreshed keys are listed on the Cloud Keys > AWS > AWS Keys page. Refer to Viewing AWS Keys for details.

Viewing/Editing Details of AWS Accounts

The AWS KMS Accounts page shows the list of existing AWS KMS accounts. Search for the KMS accounts by KMS Name or KMS Account ID.

Viewing AWS Account Details

To view the details of an AWS account:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Containers > AWS KMS Accounts. The AWS KMS Accounts page displays the following details:

    ColumnDescription
    NameName of the AWS account.
    Last RefreshedWhen the AWS account was last refreshed. Never is displayed for accounts that are never refreshed.
    Account IDID of the AWS account. If the role of another AWS user is assumed, then the associated account ID is displayed.
    ConnectionName of the connection.
    CloudCloud name.
    RegionsRegions in which the account is added. If the role of another AWS user is assumed, then regions associated with the account ID are displayed.

The Assume Role ARN column is hidden by default. This column specifies Amazon Resource Name (ARN) of the assumed role. To show/hide a column, click the custom view icon (Custom View icon), select/clear the desired column, and click OK.

Editing AWS Accounts Details

To edit the details of an AWS account:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Containers > AWS KMS Accounts. The AWS KMS Accounts page is displayed. This page displays the list of added AWS accounts.

  3. Click the overflow icon (ellipsis) corresponding to the desired AWS account and click View/Edit Details. The mini detail view shows the details of the AWS KMS account, such as account ID, connection, Assume Role ARN with its external ID, and associated regions etc.

    On this page, you can perform the following:

Managing User Permissions on AWS Accounts

To work with the AWS, users/ group must have the minimum set of permissions that allow them to use the AWS resources such as keys and AWS KMS. Initially, the user only has permission to view the keys. However, if required, the CCKM administrator can grant and revoke permissions.

Note

Only the users who are member of the CCKM Users group will be granted permissions to perform actions on the AWS account. Refer to User Roles for details.

To add permission for user/group:

  1. In the ACCESS CONTROL section, click Assign User/Group.

  2. On the Assign User/Group screen, select the user or group to be assigned permissions from the User/Group drop-down list.

  3. Click Save.

The newly added user/group is displayed under Name in the Access Control section.

CCKM allows the following operations on the AWS accounts:

  • View Native Key, View BYOK Key, Add Native Key, Add BYOK Key

  • Cancel Key Delete, Schedule Key Delete

  • Delete Material, Import Material

  • Rotate Key, Refresh Key

  • Edit Key, Unassign

Granting Permission to Perform an Operation

To grant permissions to the user or group to perform any of the above mentioned operations:

  1. Select the check box under the desired operation corresponding to the desired users or groups.

    Note

    The View Native Key permission is required for granting the Add Native Key permission. If you grant the Add Native Key permission, the View Native Key permission is automatically added, even if it not granted already.

    Note

    The View BYOK Key permission is required for granting the Add BYOK Key permission. If you grant the Add BYOK Key permission, the View BYOK Key permission is automatically added, even if it not granted already.

  2. Click Update.

A success message is displayed on the screen.

Removing a Permission

To remove a permission assigned to a user or group:

  1. Clear the check box under the desired operation corresponding to the desired users or groups.

  2. Click Update.

A success message is displayed on the screen.

Removing Permission from a User/Group

To remove current permissions assigned to the user/group:

  1. Under Unassign, click the X button corresponding to the desired user/group.

  2. On the Unassign User / Unassign Group screen, click Unassign.

    Note

    Unassigning this user/group will remove all permissions currently assigned to the user/group. Are you sure you want to continue?

  3. Click Unassign.

This step removes the explicitly added permissions and restores the default permission for the user.

Modifying Connection and Regions

You can update AWS connection and AssumeRole credentials as long as they point to the same AWS account.

To change the connection linked with the AWS account:

  1. Under GENERAL INFO, from the AWS Connection drop-down list, select the desired connection.

  2. Click Update.

To add regions to the AWS account:

  1. Under GENERAL INFO, in the Available regions section, select the desired regions.

  2. Click the right arrow button (Right Arrow). The selected regions move to the Selected regions list.

  3. Click Update.

To remove regions from the AWS account:

  1. Under GENERAL INFO, in the Selected regions section, select the regions to be removed.

  2. Click the left arrow button (Left Arrow). The selected regions move to the Available regions list.

  3. Click Update.

Adding or Removing Assume Role

You can update AWS connection and AssumeRole credentials as long as they point to the same AWS account.

To add an Assume Role:

  1. Under GENERAL INFO, select Add Assume Role.

  2. Select Add Assumed Role. The following fields are displayed:

    • Assume Role: Specify the Amazon Resource Name (ARN) of the role to be assumed. This is a mandatory field.

    • Assume Role External ID: Specify the external ID for the role to be assumed.

  3. Click Test Connection. When the connection is successful, the Available regions section is populated with available regions.

  4. Add or remove regions as appropriate.

  5. Click Update.

To change an Assume Role:

  1. Under GENERAL INFO, change the following details:

    • Assume Role: Specify the Amazon Resource Name (ARN) of the role to be assumed. This is a mandatory field.

    • Assume Role External ID: Specify the external ID for the role to be assumed.

  2. Click Test Connection.

  3. Add or remove regions as appropriate.

  4. Click Update.

Deleting AWS Accounts

To delete an AWS account:

  1. Open the Cloud Key Manager application.

  2. In the left pane, click Settings > AWS Accounts. The AWS Accounts page is displayed. This page displays the list of added AWS accounts.

  3. Click the overflow icon (ellipsis) corresponding to the desired AWS account and click Delete. The Delete Key Account message is displayed.

  4. Select I wish to delete this account.

  5. Click Delete Account.

After an AWS account is deleted from the CipherTrust Manager, the keys existing in the AWS KMS account (native and BYOK) are not affected. However, you can no longer manage those keys from CCKM. The AWS services using the AWS KMS keys continue to function without any issues.

On this page