AWS imagebuilder: Rewrite Image Builder encryption at rest, KMS key, and encryption context docs
Summary
Restructures the data protection page: clarifies that Image Builder encrypts stored resources (components, container recipes, image workflows) with an AWS-owned KMS key unless a customer managed key is specified; moves encryption context into Key management, documenting that Image Builder uses the resource ARN (and workflow build version ARN for RunCommand inputs/outputs, plus aws-crypto-public-key) as encryption context and supplies it for you; updates the key policy guidance to grant the workflow execution role access; and adds IAM permission requirements: kms:GenerateDataKey for CreateWorkflow and kms:Decrypt for GetWorkflow/GetWorkflowStepExecution/ListWorkflowStepExecutions. Removes the statement about not being able to manage the Image Builder key and the old policy-example wording.
Security assessment
The added lines document encryption at rest behavior, KMS key ownership/access, encryption-context integrity binding (including the aws-crypto-public-key pair and case-sensitive context match requirement), and the specific IAM/KMS permissions (kms:GenerateDataKey, kms:Decrypt) needed to create and read encrypted workflow resources. This is security best-practice/feature documentation and permission guidance rather than a fix for a specific vulnerability or incident, so security_issue_related is false while adding security documentation.
Evidence
**CreateWorkflow** encrypts the workflow document with the caller's credentials. The caller therefore needs `kms:GenerateDataKey`. To view the workflow document with **GetWorkflow** , or the inputs and outputs of `RunCommand` steps with **GetWorkflowStepExecution** or **ListWorkflowStepExecutions** , the caller needs `kms:Decrypt`.
Diff
diff --git a/imagebuilder/latest/userguide/data-protection.md b/imagebuilder/latest/userguide/data-protection.md index 6c08229..1774399 100644 --- a//imagebuilder/latest/userguide/data-protection.md +++ b//imagebuilder/latest/userguide/data-protection.md @@ -42 +42 @@ An ISO from an untrusted source can affect the output AMI and any instances that -Image Builder encrypts data in transit and at rest by default with a service-owned KMS key, except for the following: +Image Builder encrypts the data that it stores at rest by default. @@ -44 +44 @@ Image Builder encrypts data in transit and at rest by default with a service-own - * **Custom components** – Image Builder encrypts custom components with your default KMS key, or a service-owned KMS key. +### Encryption at rest @@ -46 +46 @@ Image Builder encrypts data in transit and at rest by default with a service-own - * **Image workflows** – Image Builder can encrypt your image workflows with a customer managed key if you specify the key during workflow creation. Image Builder handles encryption and decryption with your key to run the workflows that you've configured for your images. +Image Builder encrypts the following resources with a KMS key that Image Builder owns, unless you specify your own customer managed key when you create the resource: @@ -47,0 +48 @@ Image Builder encrypts data in transit and at rest by default with a service-own + * **Components** – Image Builder encrypts the component document. @@ -48,0 +50 @@ Image Builder encrypts data in transit and at rest by default with a service-own + * **Container recipes** – Image Builder encrypts the Dockerfile template. @@ -49,0 +52 @@ Image Builder encrypts data in transit and at rest by default with a service-own + * **Image workflows** – Image Builder encrypts the workflow document. @@ -51 +53,0 @@ Image Builder encrypts data in transit and at rest by default with a service-own -You can manage your own keys through AWS KMS. However, you don't have permission to manage the Image Builder KMS key owned by Image Builder. For more information about managing your KMS keys with AWS Key Management Service, see [Getting Started](https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html) in the AWS Key Management Service Developer Guide. @@ -53 +54,0 @@ You can manage your own keys through AWS KMS. However, you don't have permission -###### Encryption context @@ -55 +55,0 @@ You can manage your own keys through AWS KMS. However, you don't have permission -To provide an additional integrity and authenticity check on your encrypted data, you have the option of including an [encryption context](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context) when you encrypt the data. When a resource is encrypted with an encryption context, AWS KMS cryptographically binds the context to the ciphertext. The resource can only be decrypted if the requester provides an exact, case-sensitive match for the context. @@ -57 +57,7 @@ To provide an additional integrity and authenticity check on your encrypted data -The policy examples in this section use an encryption context that resembles the Amazon Resource Name (ARN) of an Image Builder workflow resource. +### Key management + +You can manage your own keys through AWS KMS. However, you can't manage the KMS keys that Image Builder owns. + +###### Encryption context + +As an additional integrity and authenticity check, Image Builder uses the Amazon Resource Name (ARN) of the resource as the [encryption context](https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html) when it encrypts a component, container recipe, or workflow. For the inputs and outputs of `RunCommand` steps that Image Builder encrypts during a workflow run, Image Builder uses the ARN of the workflow build version. The encryption context also includes an `aws-crypto-public-key` key-value pair that the AWS Encryption SDK adds. AWS KMS decrypts the data key only when the request includes an exact, case-sensitive match of the encryption context. Image Builder supplies the encryption context, so you don't provide it. @@ -61 +67 @@ The policy examples in this section use an encryption context that resembles the -To add a layer of protection, you can encrypt your Image Builder workflow resources with your own customer managed key. If you use your customer managed key to encrypt the Image Builder workflows that you create, you must grant access in the key policy for Image Builder to use your key when it encrypts and decrypts workflow resources. You can revoke access at any time. However, Image Builder will not have access to any workflows that are already encrypted if you revoke access to the key. +To add a layer of protection, you can encrypt your Image Builder workflow resources with your own customer managed key. If you encrypt your Image Builder workflows with your customer managed key, two principals need permission to use the key: the principal that creates the workflow and your workflow execution role. You can revoke access at any time. If you revoke the access of your workflow execution role to the key, builds that use workflows encrypted with the key fail, because Image Builder can't decrypt the workflow document. @@ -67 +73 @@ The process to grant Image Builder access to use your customer managed key has t -To enable Image Builder to encrypt and decrypt workflow resources when it creates or uses those workflows, you must specify permissions in the KMS key policy. +When Image Builder runs your workflows, your workflow execution role decrypts the workflow document and encrypts and decrypts the inputs and outputs of `RunCommand` steps. @@ -69 +75 @@ To enable Image Builder to encrypt and decrypt workflow resources when it create -This example key policy grants access for Image Builder pipelines to encrypt workflow resources during the creation process, and decrypt workflow resources to use them. The policy also grants access for key administrators. The encryption context and resource specification use a wildcard to cover all Regions where you have workflow resources. +This example key policy grants access to your workflow execution role and grants your AWS account full access to the key. The encryption context condition uses wildcards to match the ARN of any workflow in your account, in any Region. @@ -73 +79,3 @@ As a prerequisite for using image workflows, you created an IAM workflow executi -For more information about customer managed keys, see [ Managing access to customer managed keys](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html) in the _AWS Key Management Service Developer Guide_. +**CreateWorkflow** encrypts the workflow document with the caller's credentials. The caller therefore needs `kms:GenerateDataKey`. To view the workflow document with **GetWorkflow** , or the inputs and outputs of `RunCommand` steps with **GetWorkflowStepExecution** or **ListWorkflowStepExecutions** , the caller needs `kms:Decrypt`. + +For more information about customer managed keys, see [KMS key access and permissions](https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html) in the _AWS Key Management Service Developer Guide_.