我正在在AWS上使用无服务器创建主题。一切正常,但是我想使用SSE加密主题。我如何完成这项工作。 yaml文件的格式应该是什么。到目前为止,我有
MyTopic:
Type: AWS::SNS::Topic
Properties:
TopicName: MyTopic
MyTopicPolicy:
Type: AWS::SNS::TopicPolicy
Properties:
Topics:
- Ref: MyTopic
PolicyDocument:
Id: MyTopicPolicy
Version: '2012-10-17'
Statement:
- Sid: AllowSubscribe
Effect: Allow
Principal:
AWS: <ID>
Action:
- SNS:Subscribe
Resource: !Ref MyTopic
只需添加KmsMasterKeyId
MyTopic:
Type: AWS::SNS::Topic
Properties:
TopicName: MyTopic
KmsMasterKeyId: 1234abcd-12ab-34cd-56ef-1234567890ab
如上所述,建议您在SNS主题定义中引用KMS密钥。您可以将默认KMS密钥用于SNS(别名aws/sns
),也可以创建自己的密钥
您可以在下面的CloudFormation中查看如何在同一模板中使用自己的KMS密钥创建加密主题和KMS密钥。密钥策略设置为允许通过整个AWS账户进行管理和使用,尽管您可能希望使用最低特权原则将其锁定,具体取决于您所处环境的安全要求。
---
AWSTemplateFormatVersion: '2010-09-09'
Description: Demo template for Encrypted SNS Topic
Resources:
SNSKMSKey:
Type: 'AWS::KMS::Key'
Properties:
Description: Demo KMS Key Policy
Enabled: true
EnableKeyRotation: true
KeyPolicy:
Version: 2012-10-17
Id: KmsKeyPolicy
Statement:
- Sid: SimpleKeyPolicyAllowAccountAdmin
Effect: Allow
Principal:
AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
Action:
- 'kms:*'
Resource: '*'
- Sid: SimpleKeyPolicyAllowAccountUsage
Effect: Allow
Principal:
AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
Action:
- 'kms:Decrypt'
- 'kms:Encrypt'
- 'kms:GenerateDataKey*'
- 'kms:DescribeKey'
Resource: '*'
SNSKmeKeyAlias:
Type: "AWS::KMS::Alias"
Properties:
AliasName: !Sub "alias/${AWS::StackName}-SNSEncryptionKey"
TargetKeyId: !Ref SNSKMSKey
# -- Encrypted SNS Topic -- #
EncryptedSNSTopic:
Type: AWS::SNS::Topic
Properties:
TopicName: !Sub "${AWS::StackName}-EncryptedSNSTopic"
KmsMasterKeyId: !Ref SNSKMSKey
Outputs:
KmsKeyId:
Value: !Ref SNSKMSKey
TopicArn:
Value: !Ref EncryptedSNSTopic