AWS Key Management Service

To enhance the security of your Hanzo KMS projects, you can now encrypt your secrets using an external Key Management Service (KMS). When external KMS is configured for your project, all encryption and decryption operations will be handled by the chosen KMS. This guide will walk you through the steps needed to configure external KMS support with AWS KMS.

Prerequisites

An AWS KMS Key configured as a Symmetric key and with Encrypt and Decrypt key usage. Create AWS KMS Key

Before you begin, you'll first need to choose a method of authentication with AWS from below.

Navigate to the Create IAM Role page in your AWS Console.
Select AWS Account as the Trusted Entity Type.
Select Another AWS Account and provide the appropriate Hanzo KMS AWS Account ID: use 381492033652 for the US region, and 345594589636 for the EU region. This restricts the role to be assumed only by Hanzo KMS. If you are self-hosting, provide the AWS account number where Hanzo KMS is hosted.

For Dedicated Instances: Your AWS account ID differs from the one provided above. Please reach out to Hanzo KMS support to obtain your AWS account ID.

Optionally, enable Require external ID and enter your Hanzo KMS project ID to further enhance security.

Use the following custom policy to grant the minimum permissions required by Hanzo KMS to integrate with AWS KMS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowKMSAccess",
      "Effect": "Allow",
        "Action": [
          "kms:Decrypt",
          "kms:Encrypt",
          "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}

Navigate to your IAM user and add a policy to grant the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowKMSAccess",
      "Effect": "Allow",
        "Action": [
          "kms:Decrypt",
          "kms:Encrypt",
          "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}

Setup AWS KMS in the Organization Settings

Next, you will need to follow the steps listed below to add AWS KMS for your organization.

Open encryption org settings

Add encryption org settings Click the 'Add' button to begin adding a new external KMS.

Select Encryption Provider Choose 'AWS KMS' from the list of encryption providers.

Selecting AWS as the provider will require you input the following fields.

Name for referencing the AWS KMS key within the organization.

Short description of the AWS KMS key.

Authentication mode for AWS, either "AWS Assume Role" or "Access Key".

ARN of the AWS role to assume for providing Hanzo KMS access to the AWS KMS Key (required if Authentication Mode is "AWS Assume Role")

Custom identifier for additional validation during role assumption.

AWS IAM Access Key ID for authentication (required if Authentication Mode is "Access Key").

AWS IAM Secret Access Key for authentication (required if Authentication Mode is "Access Key").

AWS region where the AWS KMS Key is located.

Key ID of the AWS KMS Key. If left blank, Hanzo KMS will generate and use a new AWS KMS Key in the specified region. AWS KMS key ID

Save your configuration to apply the settings.

You now have an AWS KMS Key configured at the organization level. You can assign these AWS KMS keys to existing Hanzo KMS projects by visiting the 'Project Settings' page.

Assign AWS KMS Key to an Existing Project

To assign the AWS KMS key you added to your organization, follow the steps below.

Open encryption project
settings

Select encryption project
settings Choose the AWS KMS key you configured earlier.

Once you have selected the KMS of choice, click save.

AWS Key Management Service

Prerequisites

Setup AWS KMS in the Organization Settings

Assign AWS KMS Key to an Existing Project

On this page