本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 用于 Amazon DocumentDB 弹性集群的静态数据加密
<a name="elastic-encryption"></a>

以下主题可帮助您了解、创建和监控 Amazon DocumentDB 弹性集群的 AWS Key Management Service 加密密钥：

**Topics**
+ [Amazon DocumentDB 弹性集群如何使用补助金 AWS KMS](#ec-encrypt-grants)
+ [创建客户托管密钥](#ec-encrypt-create)
+ [监控您的 Amazon DocumentDB 弹性集群加密密钥](#ec-encrypt-monitor)
+ [了解详情](#ec-encrypt-learn)

Amazon DocumentDB 弹性集群自动与 AWS Key Management Service (AWS KMS) 集成以进行密钥管理，并使用一种称为信封加密的方法来保护您的数据。有关信封加密的更多信息，请参阅 *AWS Key Management Service 开发人员指南*中的[信封加密](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#enveloping)。

A AWS KMS key n 是密钥的逻辑表示形式。KMS 密钥包含元数据，如密钥 ID、创建日期、描述和密钥状态。KMS 密钥还包含用于加密和解密数据的密钥材料。有关 KMS 密钥的更多信息，请参阅 *AWS Key Management Service 开发人员指南*中的 [AWS KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys)。

Amazon DocumentDB 弹性集群支持采用两种类型的密钥加密：
+ **AWS 拥有的密钥 — ** Amazon DocumentDB 弹性集群默认使用这些密钥来自动加密个人身份数据。您无法查看、管理或使用 AWS自有密钥，也无法审核其使用情况。但是，无需采取任何措施或更改任何计划即可保护用于加密数据的密钥。有关更多信息，请参阅 *AWS Key Management Service 开发人员指南*中的 [AWS 自有密钥](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk)。
+ **Customer-managed 密钥 — 您创建、拥有和管理的**对称 AWS KMS keys 密钥。由于您可以完全控制这层加密，因此可以执行以下任务：
  + 制定和维护关键策略
  + 建立和维护 IAM 策略和授权
  + 启用和禁用密钥策略
  + 轮换加密材料
  + 添加 标签
  + 创建密钥别名
  + 安排密钥删除

  有关更多信息，请参阅 *AWS Key Management Service 开发人员指南*中的[客户托管密钥](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk)。

**重要**  
您必须使用对称加密 KMS 密钥加密您的集群，因为 Amazon DocumentDB 仅支持对称加密 KMS 密钥。请勿使用非对称 KMS 密钥尝试对 Amazon DocumentDB elastic 集群中的数据进行加密。有关更多信息，请参阅AWS Key Management Service 开发人员指南**中的[非对称密钥 AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html)。  
如果 Amazon DocumentDB 不再能够有权访问集群的加密密钥（例如，在撤销密钥访问权限时），加密的集群将进入终末状态。在此情况下，您只能从备份还原集群。对于 Amazon DocumentDB，备份始终启用 1 天。此外，如果您禁用已加密 Amazon DocumentDB 集群的密钥，您最终将失去对该集群的读写访问权限。如果 Amazon DocumentDB 遇到用它无法访问的密钥加密的集群，则它会使该集群进入最终状态。在此状态下，集群不再可用，并且数据库的当前状态无法恢复。若要还原集群，您必须重新启用对 Amazon DocumentDB 的加密密钥的访问，然后从备份还原集群。

**重要**  
在已创建加密集群的 KMS 密钥后，您无法更改它。请确保先确定您的加密密钥要求，然后再创建加密的弹性集群。

## Amazon DocumentDB 弹性集群如何使用补助金 AWS KMS
<a name="ec-encrypt-grants"></a>

Amazon DocumentDB 弹性集群需要 [授权](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html) 来使用客户托管密钥。

当您创建使用客户管理密钥加密的集群时，Amazon DocumentDB 弹性集群通过向发送`CreateGrant`请求来 AWS KMS代表您创建授权。授予权限 AWS KMS 用于让 Amazon DocumentDB 弹性集群访问客户账户中的 KMS 密钥。

Amazon DocumentDB 弹性集群要求该授权对以下内部操作使用您的客户托管密钥：
+ 向发送`DescribeKey`请求， AWS KMS 以验证在创建弹性集群时输入的对称客户管理密钥 ID 是否有效。
+ 向发送`GenerateDataKey`请求， AWS KMS 要求生成由您的客户管理密钥加密的数据密钥。
+ 发送`Decrypt`请求 AWS KMS 以解密加密的数据密钥，以便它们可用于加密您的数据。
+ 您可以随时撤销授予访问权限，或删除服务对客户托管密钥的访问权限。如果您这样做，Amazon DocumentDB 弹性集群将不能访问由客户托管密钥加密的任何数据，这影响依赖于该数据的操作。

## 创建客户托管密钥
<a name="ec-encrypt-create"></a>

您可以使用 AWS 管理控制台 或 AWS KMS API 创建对称的客户管理密钥。

**对称客户托管密钥创建**

按照*AWS Key Management Service 开发者指南*中[创建对称客户管理密钥](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html)的步骤进行操作。

**密钥策略**

密钥策略控制对客户自主管理型密钥的访问。每个客户托管式密钥必须只有一个密钥策略，其中包含确定谁可以使用密钥以及如何使用密钥的声明。创建客户托管式密钥时，可以指定密钥策略。有关更多信息，请参阅位于*AWS Key Management Service 开发人员指南AWS Key Management Service 的*[概述](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)中的 KMS 密钥访问信息。

要将您的客户托管密钥配合 Amazon DocumentDB 弹性集群资源一起使用，则必须在密钥策略中允许以下 API 操作：
+ [`kms:CreateGrant`](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html)：向客户托管密钥添加授权。授予对指定 KMS 密钥的控制访问权限，这允许访问 Amazon DocumentDB 弹性集群所需的授予操作。有关授权的更多信息，请参阅 *AWS Key Management Service 开发人员指南*中的[授权 AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html)。
+ [`kms:DescribeKey`](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html)— 提供客户管理的密钥详细信息，以允许 Amazon DocumentDB 弹性集群验证密钥。
+ [`kms:Decrypt`](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html)— 允许 Amazon DocumentDB 弹性集群使用存储的加密数据密钥访问加密数据。
+ [`kms:GenerateDataKey`](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html)— 允许 Amazon DocumentDB 弹性集群生成加密的数据密钥并将其存储，因为数据密钥不会立即用于加密。

有关更多信息，请参阅密钥策略中的 AWS 服务[权限](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html)和*AWS Key Management Service 开发人员指南[中的密钥访问](https://docs.aws.amazon.com/kms/latest/developerguide/policy-evaluation.html)疑难解答*。

**通过 IAM 策略限制客户访问托管密钥**

除了 KMS 密钥策略外，您还可以在 IAM policy 略中限制 KMS 密钥权限。

您可以通过各种方式使 IAM 策略更严格。例如，要允许客户管理密钥仅用于源自 Amazon DocumentDB 弹性集群的请求，您可以将 [`kms:ViaService` 条件键 ](https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-via-service) 与 `docdb-elastic.<region-name>.amazonaws.com` 值结合使用。

有关更多信息，请参阅《AWS Key Management Service 开发人员指南》**中的 [Allowing users in other accounts to use a KMS key](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html)。

## 监控您的 Amazon DocumentDB 弹性集群加密密钥
<a name="ec-encrypt-monitor"></a>

当您将客户管理的密钥与 Amazon DocumentDB 弹性集群资源一起使用时，您可以使用 AWS CloudTrail 或亚马逊 CloudWatch 日志来跟踪亚马逊文档数据库弹性集群向其发送的请求。 AWS KMS

以下示例是`CreateGrant``GenerateDataKeyWithoutPlainText``Decrypt`、和`DescribeKey`监控由 Amazon DocumentDB 弹性集群调用的 AWS KMS key 操作 AWS CloudTrail 的事件，这些操作旨在访问由您的客户管理的密钥加密的数据：

------
#### [ CreateGrant ]

```
{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AROAIGDTESTANDEXAMPLE:Sampleuser01",
        "arn": "arn:aws:sts::111122223333:assumed-role/Admin/Sampleuser01",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE3",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AROAIGDTESTANDEXAMPLE",
                "arn": "arn:aws:iam::111122223333:assumed-role/Admin/Sampleuser01",
                "accountId": "111122223333",
                "userName": "Sampleuser01"
            },
            "webIdFederationData": {},
            "attributes": {
                "creationDate": "2023-05-09T23:04:20Z",
                "mfaAuthenticated": "false"
            }
        },
        "invokedBy": "docdb-elastic.amazonaws.com"
    },
    "eventTime": "2023-05-09T23:55:48Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "CreateGrant",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "docdb-elastic.amazonaws.com",
    "userAgent": "docdb-elastic.amazonaws.com",
    "requestParameters": {
        "retiringPrincipal": "docdb-elastic.us-east-1.amazonaws.com",
        "granteePrincipal": "docdb-elastic.us-east-1.amazonaws.com",
        "operations": [
            "Decrypt",
            "Encrypt",
            "GenerateDataKey",
            "GenerateDataKeyWithoutPlaintext",
            "ReEncryptFrom",
            "ReEncryptTo",
            "CreateGrant",
            "RetireGrant",
            "DescribeKey"
        ],
        "keyId": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE"
    },
    "responseElements": {
        "grantId": "0ab0ac0d0b000f00ea00cc0a0e00fc00bce000c000f0000000c0bc0a0000aaafSAMPLE",
        "keyId": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE"
    },
    "requestID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE",
    "eventID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE",
    "readOnly": false,
    "resources": [
        {
            "accountId": "AWS Internal",
            "type": "AWS::KMS::Key",
            "ARN": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE"
        }
    ],
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "eventCategory": "Management"
}
```

------
#### [ GenerateDataKey ]

```
{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AROAIGDTESTANDEXAMPLE:Sampleuser01",
        "arn": "arn:aws:sts::111122223333:assumed-role/Admin/Sampleuser01",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE3",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AROAIGDTESTANDEXAMPLE",
                "arn": "arn:aws:iam::111122223333:assumed-role/Admin/Sampleuser01",
                "accountId": "111122223333",
                "userName": "Sampleuser01"
            },
            "webIdFederationData": {},
            "attributes": {
                "creationDate": "2023-05-10T18:02:59Z",
                "mfaAuthenticated": "false"
            }
        },
        "invokedBy": "docdb-elastic.amazonaws.com"
    },
    "eventTime": "2023-05-10T18:03:25Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "GenerateDataKey",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "docdb-elastic.amazonaws.com",
    "userAgent": "docdb-elastic.amazonaws.com",
    "requestParameters": {
        "keySpec": "AES_256",
        "keyId": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE"
    },
    "responseElements": null,
    "requestID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE",
    "eventID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE",
    "readOnly": true,
    "resources": [
        {
            "accountId": "AWS Internal",
            "type": "AWS::KMS::Key",
            "ARN": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE"
        }
    ],
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "eventCategory": "Management"
}
```

------
#### [ Decrypt ]

```
{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AROAIGDTESTANDEXAMPLE:Sampleuser01",
        "arn": "arn:aws:sts::111122223333:assumed-role/Admin/Sampleuser01",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE3",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AROAIGDTESTANDEXAMPLE",
                "arn": "arn:aws:iam::111122223333:assumed-role/Admin/Sampleuser01",
                "accountId": "111122223333",
                "userName": "Sampleuser01"
            },
            "webIdFederationData": {},
            "attributes": {
                "creationDate": "2023-05-10T18:05:49Z",
                "mfaAuthenticated": "false"
            }
        },
        "invokedBy": "docdb-elastic.amazonaws.com"
    },
    "eventTime": "2023-05-10T18:06:19Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "Decrypt",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "docdb-elastic.amazonaws.com",
    "userAgent": "docdb-elastic.amazonaws.com",
    "requestParameters": {
        "encryptionAlgorithm": "SYMMETRIC_DEFAULT"
    },
    "responseElements": null,
    "requestID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE",
    "eventID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE",
    "readOnly": true,
    "resources": [
        {
            "accountId": "AWS Internal",
            "type": "AWS::KMS::Key",
            "ARN": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE"
        }
    ],
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "eventCategory": "Management"
}
```

------
#### [ DescribeKey ]

```
{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AROAIGDTESTANDEXAMPLE:Sampleuser01",
        "arn": "arn:aws:sts::111122223333:assumed-role/Admin/Sampleuser01",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE3",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AROAIGDTESTANDEXAMPLE",
                "arn": "arn:aws:iam::111122223333:assumed-role/Admin/Sampleuser01",
                "accountId": "111122223333",
                "userName": "Sampleuser01"
            },
            "webIdFederationData": {},
            "attributes": {
                "creationDate": "2023-05-09T23:04:20Z",
                "mfaAuthenticated": "false"
            }
        },
        "invokedBy": "docdb-elastic.amazonaws.com"
    },
    "eventTime": "2023-05-09T23:55:48Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "DescribeKey",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "docdb-elastic.amazonaws.com",
    "userAgent": "docdb-elastic.amazonaws.com",
    "requestParameters": {
        "keyId": "alias/SampleKmsKey"
    },
    "responseElements": null,
    "requestID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE",
    "eventID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE",
    "readOnly": true,
    "resources": [
        {
            "accountId": "AWS Internal",
            "type": "AWS::KMS::Key",
            "ARN": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE"
        }
    ],
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "eventCategory": "Management"
}
```

------

## 了解详情
<a name="ec-encrypt-learn"></a>

以下资源提供有关静态数据加密的更多信息：
+ 有关 AWS KMS 概念的更多信息，请参阅*AWS Key Management Service 开发者指南[中的](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html)AWS Key Management Service 基本概念*。
+ 有关 AWS KMS 安全的更多信息，请参阅《*AWS Key Management Service 开发者指南》 AWS Key Management Service[中的](https://docs.aws.amazon.com/kms/latest/developerguide/best-practices.html)安全最佳实践*。