AWS External Key Store Resources
External Key Store (XKS) resources for integration with Amazon Web Services Key Management Service (AWS KMS) allow you to manage keys held in CipherTrust Data Security Platform Service, and allows AWS KMS to use the keys for cryptographic operations on demand.
The external custom key store entity on CipherTrust Cloud Key Manager (CCKM) provides access to AWS KMS to use source key material in CipherTrust Data Security Platform Service, while preserving end user control to manage those source keys outside of AWS KMS.
The external custom key store contains Hold Your Own Key (HYOK) keys, which acts as an intermediary to the source key material stored in CipherTrust Data Security Platform Service. CipherTrust Data Security Platform Service executes the cryptographic operations.
External custom key stores and HYOK keys on CCKM can be created as linked or unlinked to an external key store in AWS KMS. Linked key stores and keys automatically synchronize with objects in AWS KMS, and unlinked key stores do not. Unlinked key stores and HYOK keys require you to either link those objects, which automatically creates corresponding external key stores and KMS keys on AWS KMS, or to manually create corresponding objects in AWS KMS.
Required Resources
- An AWS Account.
Network Topology
AWS KMS accesses CipherTrust Data Security Platform Service through a public routable connection, and uses CipherTrust Data Security Platform Service as as a key source.
Network Considerations for Optimal Stability and Performance
There are some important network considerations for deployments of an external key store.
-
When CipherTrust Data Security Platform Service is the key source, we recommend a network latency of round-trip communication of 35 ms or less between AWS KMS and the CipherTrust Data Security Platform Service.
-
We recommend preparing only one or two external key stores per deployment.
High Level Integration Process Using CipherTrust Manager as a Key Source
These are the high level steps to allow AWS KMS to begin making cryptographic requests to CipherTrust Data Security Platform Service source keys through external custom key stores within CCKM. Unlinked external custom key stores and HYOK keys require additional steps.
-
Prepare an External Custom Key Store.
As part of this process, you establish a CipherTrust Data Security Platform Service connection to the AWS account and create an external custom key store on CCKM.
-
If you created an unlinked key store on CCKM, you must either link the key store or create a corresponding external key store on AWS KMS, as described in AWS Key Management Service Deployment Guide.
-
If you have created an unlinked HYOK key on CCKM, either link the key or create a KMS key in the AWS external key store, associated with the the HYOK key on CCKM.
AWS and CCKM Terminology
Terms used in AWS documentation, API, or AWS Console can differ from terms used in CCKM documentation, CipherTrust Data Security Platform Service REST API, and CipherTrust Data Security Platform Service web console for the same concepts. The following table provides equivalencies.
| AWS term(s) | CCKM term(s) | Notes |
|---|---|---|
| External key | CipherTrust Data Security Platform Service source key | Generally refers to the key material which performs cryptographic operations. |
External Key ID, XksKeyId |
XKS ID, XksKeyConfiguration:Id, HYOK ID |
This is the key identifier which AWS KMS specifies in cryptographic requests. Important Note: This XKS ID is associated with the HYOK. It is not the source CipherTrust Data Security Platform Service or Luna HSM key's ID. |
| External Key Store | External Custom Key Store, Custom Key Store | CCKM documentation refers to the CCKM object as external custom key store and the AWS object as external key store. Product interfaces may use these terms interchangeably. |
Proxy URI endpoint |
XKS Proxy URI Endpoint |
This value is the CipherTrust Data Security Platform Service domain name, https://ciphertrust.dpondemand.io. This is the hostname to which AWS KMS first connects for cryptographic requests. |
Proxy URI Path |
XKS Proxy URI Path | This is the path associated with an external custom key store in CCKM. |
| XKS proxy configuration file | Credentials file | The downloadable file available in CCKM when you create a new external custom key store or rotate the credentials for an external custom key store. This file contains the external custom key store's Proxy URI path prefix, Access key ID, and Secret access key values. |
