最小KMS權限複製數據庫快照

我想設置最小的權限與KMS密鑰做aws rds copy-db-snapshot：最小KMS權限複製數據庫快照

$ aws rds copy-db-snapshot --source-db-snapshot-identifier rds-backup-share- 
mysql --target-db-snapshot-identifier rds-backup-share-mysql-reencrypted --kms-key-id <kms-arn>

（內<>一切都是由我剝離出來，幷包含有效的值。）

不幸的是我得到這個錯誤：

An error occurred (KMSKeyNotAccessibleFault) when calling the CopyDBSnapshot operation: The target snapshot KMS key [<kms-arn>] does not exist, is not enabled or you do not have permissions to access it.

目前我允許這些行動：

"Action": [ 
    "kms:ReEncrypt*", 
    "kms:ListKeys", 
    "kms:ListAliases", 
    "kms:GenerateDataKey*", 
    "kms:Encrypt", 
    "kms:DescribeKey", 
    "kms:Decrypt" 
    ],

如果我將其替換爲kms:*{code}，它將起作用，因此它必須是許可問題。

我試圖找出CloudTrail的正確權限，但它只包含相同的無用的錯誤消息。

所以我實際的問題：

哪些CopyDBSnapshot最小的KMS權限？
有沒有一種通用的方法來找出所需的權限？通過使用所需的權限來浪費我的時間總是很痛苦。

編輯：這是與--debug日誌輸出啓用底部：

2017-08-22 17:15:37,521 - MainThread - botocore.endpoint - DEBUG - Sending http request: <PreparedRequest [POST]> 
2017-08-22 17:15:37,522 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTPS connection (1): rds.eu-west-1.amazonaws.com 
2017-08-22 17:15:37,927 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "POST/HTTP/1.1" 400 437 
2017-08-22 17:15:37,934 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-requestid': 'c097fe4e-874c-11e7-a56a-9d1acedaf516', 'content-type': 'text/xml', 'content-length': '437', 'date': 'Tue, 22 Aug 2017 15:15:37 GMT', 'connection': 'close'} 
2017-08-22 17:15:37,936 - MainThread - botocore.parsers - DEBUG - Response body: 
b'<ErrorResponse xmlns="http://rds.amazonaws.com/doc/2014-10-31/">\n <Error>\n <Type>Sender</Type>\n <Code>KMSKeyNotAccessibleFault</Code>\n <Message>The target snapshot KMS key [<kms-arn>] does not exist, is not enabled or you do not have permissions to access it. </Message>\n </Error>\n <RequestId>c097fe4e-874c-11e7-a56a-9d1acedaf516</RequestId>\n</ErrorResponse>\n' 
2017-08-22 17:15:37,938 - MainThread - botocore.hooks - DEBUG - Event needs-retry.rds.CopyDBSnapshot: calling handler <botocore.retryhandler.RetryHandler object at 0x7f9c7ce84860> 
2017-08-22 17:15:37,939 - MainThread - botocore.retryhandler - DEBUG - No retry needed. 
2017-08-22 17:15:37,952 - MainThread - awscli.clidriver - DEBUG - Exception caught in main() 
Traceback (most recent call last): 
    File "/usr/lib/python3.6/site-packages/awscli/clidriver.py", line 200, in main 
    return command_table[parsed_args.command](remaining, parsed_args) 
    File "/usr/lib/python3.6/site-packages/awscli/clidriver.py", line 338, in __call__ 
    return command_table[parsed_args.operation](remaining, parsed_globals) 
    File "/usr/lib/python3.6/site-packages/awscli/clidriver.py", line 508, in __call__ 
    call_parameters, parsed_globals) 
    File "/usr/lib/python3.6/site-packages/awscli/clidriver.py", line 627, in invoke 
    client, operation_name, parameters, parsed_globals) 
    File "/usr/lib/python3.6/site-packages/awscli/clidriver.py", line 639, in _make_client_call 
    **parameters) 
    File "/usr/lib/python3.6/site-packages/botocore/client.py", line 310, in _api_call 
    return self._make_api_call(operation_name, kwargs) 
    File "/usr/lib/python3.6/site-packages/botocore/client.py", line 599, in _make_api_call 
    raise error_class(parsed_response, operation_name) 
botocore.errorfactory.KMSKeyNotAccessibleFault: An error occurred (KMSKeyNotAccessibleFault) when calling the CopyDBSnapshot operation: The target snapshot KMS key [<kms-arn>] does not exist, is not enabled or you do not have permissions to access it. 
2017-08-22 17:15:37,955 - MainThread - awscli.clidriver - DEBUG - Exiting with rc 255 

An error occurred (KMSKeyNotAccessibleFault) when calling the CopyDBSnapshot operation: The target snapshot KMS key [<kms-arn>] does not exist, is not enabled or you do not have permissions to access it.

FTR：我做了一個交叉發佈到AWS論壇：https://forums.aws.amazon.com/thread.jspa?messageID=801745

來源

2017-08-22 svenwltr

你可以添加--debug到aws rds命令併發布嗎？ –

我從實際的HTTP請求中添加了調試輸出。 – svenwltr

您是否嘗試了託管策略作爲指定自己的替代方案？嘗試將以下策略添加到角色中：請參閱'arn：aws：iam :: aws：policy/AWSKeyManagementServicePowerUser' –

現在，我通過反覆試驗找出了它。由於我不喜歡多次執行同一任務，因此我將其自動化（請參閱下面的腳本）。

這是一個複製快照RDS所需的權限：

["kms:CreateGrant","kms:DescribeKey"]

這是我使用的腳本。也許這對其他有類似問題的人有用。它被一起黑了，所以不要指望它能夠在盒子裏運行。

#!/bin/bash 

set -euo pipefail 

unknown=(
    kms:CancelKeyDeletion 
    kms:CreateAlias 
    kms:CreateAlias 
    kms:CreateGrant 
    kms:CreateKey 
    kms:Decrypt 
    kms:DeleteAlias 
    kms:DeleteAlias 
    kms:DescribeKey 
    kms:DisableKey 
    kms:DisableKeyRotation 
    kms:EnableKey 
    kms:EnableKeyRotation 
    kms:Encrypt 
    kms:GenerateRandom 
    kms:GenerateDataKey 
    kms:GenerateDataKeyWithoutPlaintext 
    kms:GetKeyPolicy 
    kms:GetKeyRotationStatus 
    kms:ListAliases 
    kms:ListGrants 
    kms:ListKeyPolicies 
    kms:ListKeys 
    kms:ListRetirableGrants 
    kms:PutKeyPolicy 
    kms:ReEncryptFrom 
    kms:ReEncryptTo 
    kms:RetireGrant 
    kms:RevokeGrant 
    kms:ScheduleKeyDeletion 
    kms:UpdateAlias 
    kms:UpdateAlias 
    kms:UpdateKeyDescription 
) 
required=() 

KEY_ID=86a6300d-38f9-4892-b7a1-d8f821e8438c 
export AWS_DEFAULT_OUTPUT=json 

function check_copy { 
    permissions=$(echo -n "${required[*]} ${unknown[*]}" | jq -R -s 'split(" ")') 

    policy=$(aws kms \ 
     get-key-policy \ 
     --key-id ${KEY_ID} \ 
     --policy-name default \ 
     | jq ".Policy" -r \ 
     | jq ".Statement[1].Action |= ${permissions}" 
    ) 

    aws kms \ 
     put-key-policy \ 
     --key-id ${KEY_ID} \ 
     --policy-name default \ 
     --policy "${policy}" 

    aws rds \ 
     delete-db-snapshot \ 
     --db-snapshot-identifier rds-backup-share-mysql-reencrypted \ 
     || true 

    (
     set -x 
     AWS_ACCESS_KEY_ID=XXX \ 
     AWS_SECRET_ACCESS_KEY=XXX \ 
     aws rds \ 
      copy-db-snapshot \ 
      --source-db-snapshot-identifier rds-backup-share-mysql \ 
      --target-db-snapshot-identifier rds-backup-share-mysql-reencrypted \ 
      --kms-key-id alias/rds-snapshot-share \ 
      || return 1 

    aws rds \ 
     wait db-snapshot-completed \ 
     --db-snapshot-identifier rds-backup-share-mysql-reencrypted 
    ) || return 1 

    return 0 
} 

check_copy 
while [ ${#unknown[@]} -gt 0 ] 
do 
    removed=${unknown[0]} 
    unknown=(${unknown[@]:1}) 

    if ! check_copy 
    then 
     required+=($removed) 
    fi 

    echo "Required permissions so far: ${required[*]}" 
    echo "Unknown permissions so far: ${unknown[*]}" 
done 

echo -n "Minimal permissions: " 
echo -n "${required[*]}" | jq -R -s -c 'split(" ")'

來源

2017-08-25 12:55:23 svenwltr

最小KMS權限複製數據庫快照

回答

相關問題