Bring Your Own Key for AWS Key Management Service and Entrust KeyControl: Integration Guide

This guide describes how to configure the Entrust KeyControl server as a KMS in AWS BYOK.

To install and configure the Entrust KeyControl server as a KMIP server, see the Entrust KeyControl nshield HSM Integration Guide . You can access this in the Entrust Document Library.

Also refer to the documentation and set-up process for AWS Key Management Service (KMS) in AWS Key Management Service .

Also refer to video for the set-up process with IAM at Getting Started with AWS Identity and Access Management .

Entrust has successfully tested the integration of KeyControl with Azure BYOK in the following configurations:

Follow the installation and set-up instructions in the Entrust KeyControl nshield HSM Integration Guide . You can access this in the Entrust Document Library.

To create a customer managed policy in AWS:

1. Go to the IAM Service and select Access management > Policies from the left menu.

2. On the Policies page, select Actions > Create Policy . For example:

3. On the Create Policy page, select Chose a service and search for IAM . Select the following permissions:

   • IAM GetUser .

   • IAM ListUsers .

   • IAM ListAccessKeys .

   • IAM CreateAccessKey .

   • IAM DeleteAccessKey .

   • IAM UpdateAccessKey .

4. Select Add additional permissions . Select Chose a service and search for KMS . Select the following permissions:

   • All KMS actions .

5. Select Add additional permissions . Select Chose a service and search for EC2 . Select the following permissions:

   • DescribeRegions .

6. Select Add additional permissions . Select Chose a service and search for Systems Manager . Select the following permissions:

   • GetParameter .

   The permissions should be listed as follows:

7. Select the JSON tab. For example:

   If there are warnings with the resource group, click All resources .

8. Select Next: Tags and add any appropriate tags.

9. Select Next: Review and enter values for the following properties:

   • Name .

   • Description .

   • Summary .

10. Select Create policy . For example:

For further information, refer to the AWS BYOK Service Account Requirements in the KeyControl online documentation.

To create IAM User in AWS:

1. Go to the IAM Service and select Access management > Add users from the left menu.

2. On the Users page, select Add users . For example:

3. Enter values for the following properties:

   • User name .

   • Select AWS credential type .

   • Console password .

   For example:

4. Add the user to a group that complies with your organization’s standards.

5. Add the necessary tags. For example:

6. Review the permissions and then select Create user . For example:

7. Click the hyperlink to download the credentials of the new user. For example:

To attach a policy to an IAM user in AWS:

1. Go to the IAM Service and select Access management > Policies from the left menu.

2. On the Policies page, select your policy ( aws-byok-policy ).

3. Select Actions > Attach .

4. Search for your IAM User ( AWSBYOKKeycontrolUser ) in the search bar and select Attach policy .

To create an AWS CSP account:

1. In KeyControl, select BYOK on the main toolbar.

2. Select the CSP Accounts tab.

3. Select Actions > Add CSP Account .

   The Add CSP Account dialog appears.

4. In the Details tab, enter the information downloaded during the Create IAM User in AWS process. For example:

   Note	The region selected has to match your AWS region.

5. In the Schedule tab, enter your organization’s standard rotation schedule.

6. Select Apply .

To create a key set in KeyControl:

1. In KeyControl, select BYOK on the main toolbar.

2. Select the Key Sets tab.

3. Select Actions > Create Key Set .

   The Create Key Set dialog appears.

4. In the Details tab, enter a Name and Description for the key set. For example:

5. Select Continue .

6. In the CSP Account tab, select the account previously created ( awsbyokkeycontrol ). For example:

   Note	If no accounts exist, select Add CSP Account and add the CSP account, see Create an AWS CSP account .

7. Select Continue .

8. In the HSM tab, check if an HSM is configured. For example:

   If no HSM is configured, configure one and then enable it in Create Key Set .

9. Select Continue .

10. In the Schedule tab, select a Rotation Schedule matching the selection made during Create an AWS CSP account . For example:

11. Select Apply .

    The key set is added. For example:

For further information, refer to Creating a Key Set in the KeyControl online documentation.

To create a cloud key in KeyControl: ttach a policy to an IAM user in AWS . In KeyControl, select BYOK on the toolbar.

1. Select the CloudKeys tab.

2. Select the Key Set and Region . For example:

3. Select Actions > Create CloudKey .

   The Create CloudKey dialog appears.

4. In the Details tab, enter the Name and Description . For example:

5. Select Continue .

6. In the Access tab, select the required access for. For example:

7. Select Continue .

8. In the Schedule tab:

   1. Select a Rotation Schedule .

   2. Set Expiration .

   For example:

9. Select Continue .

   The cloud key is created.

10. Verify the cloud key is visible in the AWS Key Management Service (KMS).

For further information, refer to Creating a CloudKey in the KeyControl online documentation.

To create a cloud key in the AWS Key Management Service:

1. Navigate to Services > Key Management Service > Customer managed keys > Create Key .

   The Create a key dialog appears.

2. Enter the following properties for Step 1: Configure key .

3. Select Next .

4. Enter the following properties for Step 2: Add labels .

5. Select Next .

6. Enter the following properties for Step 3: Define key administrative permissions .

7. Select Next .

8. Enter the following properties for Step 4: Define key usage permissions .

9. Select Next .

10. Confirm all information in Step 5: Review .

11. Note the new key in the AWS KMS.

To import the cloud key in KeyControl:

1. Select BYOK on the toolbar.

2. Select the Key Sets tab and select awsbyokkeyset .

3. Select Actions > Import CloudKey . The Import Cloud Keys dialog appears.

4. Select Import . The key is imported.

5. Select the CloudKeys tab and select Refresh .

6. Verify the imported key. For example:

For further information, refer to Importing a CloudKey in the KeyControl online documentation.

To remove a cloud key in KeyControl:

1. In KeyControl, select BYOK on the main toolbar.

2. Select the CloudKeys tab.ttach a policy to an IAM user in AWS

3. Select the key to the removed. For example, AWSCloudKey .

4. Select Actions > Remove from Cloud .

   The Remove from Cloud dialog appears.

5. Type the name of the key in Type CloudKey Name . For example:

6. Select Remove .

   The cloud key is removed from KeyControl. Its Cloud Status becomes NOT AVAILABLE . For example:

7. Verify the key is gone in AWS KMS. For example:

For further information, refer to Removing a CloudKey from the Cloud in the KeyControl online documentation.

To delete a cloud key in KeyControl:

1. In KeyControl, select BYOK on the toolbar.

2. Select the CloudKeys tab.

3. Select the key to the removed. For example, AWSCloudKey .

4. Select Actions > Delete CloudKey .

   The Delete CloudKey dialog appears.

5. Select a time in Define when the CloudKey should be permanently deleted . For example:

6. Select Delete .

   The cloud key is deleted from KeyControl. The Cloud Status becomes PENDING DELETE . For example:

7. Verify the key turns into Pending deletion in AWS KMS. For example:

For further information, refer to Deleting a CloudKey from the Cloud in the KeyControl online documentation.

To cancel a cloud key deletion in KeyControl:

1. In KeyControl, select BYOK on the toolbar.

2. Select the CloudKeys tab.

3. Select the key for which you want to cancel a deletion. For example, AWSCloudKey .

4. Select Actions > Cancel Deletion .

   The Cancel Deletion dialog appears. For example:

5. Select Cancel Delete .

   The deletion is cancelled.

6. Verify the status change in KeyControl. For example:

7. Verify the key is now available in Azure. For example:

For further information, refer to Canceling a CloudKey Deletion in the KeyControl online documentation.

To rotate a cloud key in KeyControl:

1. In KeyControl, select BYOK on the toolbar.

2. Select the CloudKeys tab.

3. Select the key you want to rotate. Scroll down and select the Rotate Now control. For example:

4. Select Rotate Now .

   The key is rotated.

5. Verify that the key has been rotated in AWS KMS. For example: