AWS KMS + CloudHSM [WvdS Doku]

Diese Seite ist nicht editierbar. Sie können den Quelltext sehen, jedoch nicht verändern. Kontaktieren Sie den Administrator, wenn Sie glauben, dass hier ein Fehler vorliegt.
====== AWS KMS + CloudHSM ======

<WRAP round info>
**Cloud:** Amazon Web Services \\
**HSM Level:** FIPS 140-2 Level 3 (CloudHSM) / Level 2 (KMS) \\
**PQ Support:** Not yet available (as of 2024)
</WRAP>

Integration of AWS Key Management Service and CloudHSM for PKI operations.

----

===== Architecture =====

<mermaid>
flowchart TB
    subgraph AWS["AWS"]
        subgraph KMS["KMS"]
            K[Customer Managed Keys]
            AK[AWS Managed Keys]
        end
        subgraph CHSM["CloudHSM Cluster"]
            H1[HSM 1]
            H2[HSM 2]
        end
        subgraph ACM["Certificate Manager"]
            PC[Private CA]
            C[Certificates]
        end
        subgraph APPS["Applications"]
            EC2[EC2]
            EKS[EKS]
            Lambda[Lambda]
        end
    end

    subgraph ONPREM["ON-PREM"]
        CA[Root CA]
    end

    CA -->|Cross-Sign| PC
    K --> APPS
    PC --> C --> APPS
    CHSM --> KMS

    style KMS fill:#fff3e0
    style CHSM fill:#e8f5e9
</mermaid>

----

===== AWS KMS Setup =====

==== Create CMK (Customer Managed Key) ====

<code bash>
# AWS CLI
aws kms create-key \
    --description "PKI Signing Key" \
    --key-usage SIGN_VERIFY \
    --key-spec ECC_NIST_P384 \
    --tags TagKey=Environment,TagValue=Production

# Create alias
aws kms create-alias \
    --alias-name alias/pki-signing-key \
    --target-key-id <key-id>

# Key Policy
aws kms put-key-policy \
    --key-id <key-id> \
    --policy-name default \
    --policy file://key-policy.json
</code>

<code json>
// key-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:root"},
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow signing",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:role/PKI-Signing-Role"},
      "Action": ["kms:Sign", "kms:Verify", "kms:GetPublicKey"],
      "Resource": "*"
    }
  ]
}
</code>

==== Sign with KMS ====

<code csharp>
// C# - AWS SDK Signing
using Amazon.KeyManagementService;
using Amazon.KeyManagementService.Model;

var kmsClient = new AmazonKeyManagementServiceClient();

// Sign data
byte[] dataToSign = Encoding.UTF8.GetBytes("Document content");
byte[] digest = SHA384.HashData(dataToSign);

var signRequest = new SignRequest
{
    KeyId = "alias/pki-signing-key",
    Message = new MemoryStream(digest),
    MessageType = MessageType.DIGEST,
    SigningAlgorithm = SigningAlgorithmSpec.ECDSA_SHA_384
};

SignResponse signResponse = await kmsClient.SignAsync(signRequest);
byte[] signature = signResponse.Signature.ToArray();

Console.WriteLine($"Signature: {Convert.ToBase64String(signature)}");

// Verify
var verifyRequest = new VerifyRequest
{
    KeyId = "alias/pki-signing-key",
    Message = new MemoryStream(digest),
    MessageType = MessageType.DIGEST,
    Signature = new MemoryStream(signature),
    SigningAlgorithm = SigningAlgorithmSpec.ECDSA_SHA_384
};

VerifyResponse verifyResponse = await kmsClient.VerifyAsync(verifyRequest);
Console.WriteLine($"Valid: {verifyResponse.SignatureValid}");
</code>

----

===== AWS CloudHSM =====

==== Create Cluster ====

<code bash>
# Create CloudHSM cluster
aws cloudhsmv2 create-cluster \
    --hsm-type hsm1.medium \
    --subnet-ids subnet-12345678 subnet-87654321

# Add HSM to cluster
aws cloudhsmv2 create-hsm \
    --cluster-id cluster-abc123 \
    --availability-zone eu-central-1a

# Initialize cluster (requires CloudHSM client)
/opt/cloudhsm/bin/cloudhsm_mgmt_util /opt/cloudhsm/etc/cloudhsm_mgmt_util.cfg

# In CMU:
# > loginHSM PRECO admin password
# > changePswd PRECO admin <new-password>
</code>

==== Key Generation in CloudHSM ====

<code bash>
# CloudHSM PKCS#11 Key Generation
pkcs11-tool --module /opt/cloudhsm/lib/libcloudhsm_pkcs11.so \
    --login --pin <CU-password> \
    --keypairgen --key-type EC:secp384r1 \
    --label "ca-signing-key" \
    --id 01
</code>

==== CloudHSM with KMS (Custom Key Store) ====

<code bash>
# Create Custom Key Store
aws kms create-custom-key-store \
    --custom-key-store-name cloudhsm-keystore \
    --cloud-hsm-cluster-id cluster-abc123 \
    --trust-anchor-certificate file://customerCA.crt \
    --key-store-password <kmsuser-password>

# Connect Key Store
aws kms connect-custom-key-store \
    --custom-key-store-id cks-abc123

# Create key in Custom Key Store
aws kms create-key \
    --origin AWS_CLOUDHSM \
    --custom-key-store-id cks-abc123 \
    --key-spec ECC_NIST_P384 \
    --key-usage SIGN_VERIFY
</code>

----

===== AWS Certificate Manager Private CA =====

==== Create Private CA ====

<code bash>
# CA configuration
cat > ca-config.json << 'EOF'
{
  "KeyAlgorithm": "EC_secp384r1",
  "SigningAlgorithm": "SHA384WITHECDSA",
  "Subject": {
    "Country": "DE",
    "Organization": "Example Organization",
    "CommonName": "Example Private CA"
  }
}
EOF

# Create Private CA
aws acm-pca create-certificate-authority \
    --certificate-authority-configuration file://ca-config.json \
    --certificate-authority-type SUBORDINATE \
    --tags Key=Environment,Value=Production

# Generate CSR
aws acm-pca get-certificate-authority-csr \
    --certificate-authority-arn <ca-arn> \
    --output text > ca.csr

# Have CSR signed by Root CA (external)
# ...

# Import CA certificate
aws acm-pca import-certificate-authority-certificate \
    --certificate-authority-arn <ca-arn> \
    --certificate file://ca-cert.pem \
    --certificate-chain file://chain.pem
</code>

==== Issue Certificate ====

<code bash>
# CSR for end entity
openssl req -new -key server.key -out server.csr \
    -subj "/CN=server.example.com"

# Issue certificate
aws acm-pca issue-certificate \
    --certificate-authority-arn <ca-arn> \
    --csr fileb://server.csr \
    --signing-algorithm SHA384WITHECDSA \
    --validity Value=365,Type=DAYS \
    --template-arn arn:aws:acm-pca:::template/EndEntityCertificate/V1

# Retrieve certificate
aws acm-pca get-certificate \
    --certificate-authority-arn <ca-arn> \
    --certificate-arn <cert-arn> \
    --output text > server.pem
</code>

----

===== EKS Integration =====

<code yaml>
# IRSA (IAM Roles for Service Accounts)
# trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "Federated": "arn:aws:iam::123456789012:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E"
    },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
      "StringEquals": {
        "oidc.eks.eu-central-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub": "system:serviceaccount:pki:cert-manager"
      }
    }
  }]
}
</code>

<code yaml>
# ServiceAccount for cert-manager
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cert-manager
  namespace: pki
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/PKI-CertManager-Role
---
# ClusterIssuer for ACM Private CA
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: aws-pca-issuer
spec:
  acmPrivateCA:
    arn: arn:aws:acm-pca:eu-central-1:123456789012:certificate-authority/abc123
    region: eu-central-1
</code>

----

===== Lambda Integration =====

<code python>
# lambda_function.py
import boto3
import base64
import hashlib

kms_client = boto3.client('kms')

def lambda_handler(event, context):
    data = event['data'].encode('utf-8')
    digest = hashlib.sha384(data).digest()

    # Sign
    sign_response = kms_client.sign(
        KeyId='alias/pki-signing-key',
        Message=digest,
        MessageType='DIGEST',
        SigningAlgorithm='ECDSA_SHA_384'
    )

    signature = base64.b64encode(sign_response['Signature']).decode()

    return {
        'statusCode': 200,
        'signature': signature
    }
</code>

----

===== Monitoring =====

<code bash>
# CloudWatch Alarm for KMS
aws cloudwatch put-metric-alarm \
    --alarm-name kms-signing-errors \
    --metric-name Errors \
    --namespace AWS/KMS \
    --statistic Sum \
    --period 300 \
    --threshold 1 \
    --comparison-operator GreaterThanOrEqualToThreshold \
    --dimensions Name=KeyId,Value=<key-id> \
    --evaluation-periods 1 \
    --alarm-actions arn:aws:sns:eu-central-1:123456789012:pki-alerts
</code>

----

===== Cost Overview =====

| Service | Cost (approx.) | Note |
|---------|----------------|------|
| KMS CMK | $1/month + $0.03/10k requests | Standard |
| CloudHSM | ~$1.50/hour (~$1100/month) | Per HSM |
| ACM Private CA | $400/month + $0.75/cert | Per CA |

----

===== Checklist =====

| # | Checkpoint | Done |
|---|------------|------|
| 1 | KMS key created | |
| 2 | Key policy configured | |
| 3 | IAM roles created | |
| 4 | CloudTrail enabled | |
| 5 | CloudWatch alarms | |
| 6 | Backup strategy | |

----

===== Related Documentation =====

  * [[.:azure-keyvault|Azure Key Vault]] - Alternative cloud
  * [[.:hashicorp-vault|HashiCorp Vault]] - Multi-cloud
  * [[..:automatisierung:cert-manager-k8s|Kubernetes Cert-Manager]] - EKS integration

----

<< [[.:azure-keyvault|<- Azure Key Vault]] | [[.:hashicorp-vault|-> HashiCorp Vault]] >>

----
//Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional//

{{tag>aws kms cloudhsm acm cloud operator}}
Seiten-Werkzeuge
