How can i share my UAT account's customer managed kms key to production account

0

Hi, so the scenario is i have enabled AWS Backup in my UAT account and i am taking backup of my EC2 instances. so i read somewhere that i need to share kms key, I want to know how can i share my customer managed key from UAT account to Prod account? so, i have to add permission with principal to specific key which i want to share with Prod account. and in prod account also i have added permission to use that key. But still i am not able to see the shared key in Prod account. Both account are part of organization.

2回答
0
  1. Go to Key Management Service
  2. Select your Key from Customer managed keys
  3. On the bottom you will see the Other AWS Accounts. Click on Add other accounts and enter your AWS account Enter your AWS account
Nov
回答済み 6ヶ月前
  • I did already, but this doesn't work

0

When you grant access to an external account to use your custom key, keep in mind four important things:

  1. The key will not appear anywhere in the AWS Management Console for administrators of the external account to directly manage or select when creating encrypted resources. The administrator of the external account will need to specify the key’s ARN to use the key to create encrypted resources.
  2. After you grant access to external accounts, root users of those external accounts can execute the following actions using your key: Encrypt, Decrypt, ReEncrypt, GenerateDataKey, and DescribeKey.
  3. AWS services integrated with KMS can use your key on behalf of external accounts for which you have enabled cross-account access.
  4. IAM users and roles in the external account will not be able to use the key unless the account administrator of the external account creates and attaches a resource-level policy that specifies the KMS key ARN and permitted actions.

To know more about how to share Custom Encryption Keys More Securely Between Accounts by Using AWS Key Management Service, kindly refer the below blog.

[+] https://aws.amazon.com/blogs/security/share-custom-encryption-keys-more-securely-between-accounts-by-using-aws-key-management-service/

AWS
回答済み 6ヶ月前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ