awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2199 from Infisical/secret-engine-v2-bridge

Browse Source 
Secret engine v2 bridge
This commit is contained in:
Maidul Islam
2024-07-30 21:41:21 -04:00
committed by GitHub
parent 7a7841e487 f7c962425c
commit 5bb2866b28
192 changed files with 13069 additions and 2766 deletions
Download Patch File Download Diff File Expand all files Collapse all files

148
docs/documentation/platform/kms/aws-kms.mdx Normal file
View File

@@ -0,0 +1,148 @@
---
title: "AWS Key Management Service (KMS)"
description: "Learn how to manage encryption using AWS KMS"
---
You can configure your projects to use AWS KMS keys for encryption, enhancing the security and management of your secrets.
## Prerequisites
Depending on the AWS Authentication Method you intend to use, you will have to do either of the following:
<Tabs>
<Tab title="Assume Role (Recommended)">
<Steps>
<Step title="Create the Managing User IAM Role">
1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
![IAM Role Creation](../../images/integrations/aws/integration-aws-iam-assume-role.png)
2. Select **AWS Account** as the **Trusted Entity Type**.
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
4. Optionally, enable **Require external ID** and enter your **project ID** to further enhance security.
</Step>
<Step title="Add Required Permissions for the IAM Role">
Use the following custom policy to grant the minimum permissions required by Infisical to integrate with AWS KMS
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKMSAccess",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:DescribeKey"
],
"Resource": "*"
}
]
}
```
</Step>
</Steps>
</Tab>
<Tab title="Access Key">
Navigate to your IAM user and add a policy to grant the following permissions:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKMSAccess",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:DescribeKey"
],
"Resource": "*"
}
]
}
```
</Tab>
</Tabs>
## Setup AWS KMS in the Organization Settings
Follow these steps to set up AWS KMS for your organization:
<Steps>
<Step title="Navigate to the organization settings and select the Encryption tab.">
![Open encryption org settings](../../../images/platform/kms/aws/encryption-org-settings.png)
</Step>
<Step title="Click on the 'Add' button">
![Add encryption org settings](../../../images/platform/kms/aws/encryption-org-settings-add.png)
Click the 'Add' button to begin adding a new external KMS.
</Step>
<Step title="Select 'AWS KMS'">
![Select Encryption Provider](../../../images/platform/kms/aws/encryption-modal-provider-select.png)
Choose 'AWS KMS' from the list of encryption providers.
</Step>
<Step title="Provide the inputs for AWS KMS">
Fill in the required details for AWS KMS:
<ParamField path="Alias" type="string" required>
Name for referencing the AWS KMS key within the organization.
</ParamField>
<ParamField path="Description" type="string">
Short description of the AWS KMS key.
</ParamField>
<ParamField path="Authentication Mode" type="string" required>
Authentication mode for AWS, either "AWS Assume Role" or "Access Key".
</ParamField>
<ParamField path="IAM Role ARN For Role Assumption" type="string" required>
ARN of the AWS role to assume for providing Infisical access to the AWS KMS Key (required if Authentication Mode is "AWS Assume Role")
</ParamField>
<ParamField path="Assume Role External ID" type="string">
Custom identifier for additional validation during role assumption.
</ParamField>
<ParamField path="Access Key ID" type="string" required>
AWS IAM Access Key ID for authentication (required if Authentication Mode is "Access Key").
</ParamField>
<ParamField path="Secret Access Key" type="string" required>
AWS IAM Secret Access Key for authentication (required if Authentication Mode is "Access Key").
</ParamField>
<ParamField path="AWS Region" type="string" required>
AWS region where the AWS KMS Key is located.
</ParamField>
<ParamField path="AWS KMS Key ID" type="string">
Key ID of the AWS KMS Key. If left blank, Infisical will generate and use a new AWS KMS Key in the specified region.
![AWS KMS key ID](../../../images/platform/kms/aws/aws-kms-key-id.png)
</ParamField>
</Step>
<Step title="Click Save">
Save your configuration to apply the settings.
</Step>
</Steps>
You now have an AWS KMS Key configured at the organization level. You can assign these keys to existing projects via the Project Settings page.
## Assign AWS KMS Key to an Existing Project
Follow these steps to assign an AWS KMS key to a project:
<Steps>
<Step title="Open Project Settings and proceed to the Encryption Tab">
![Open encryption project
settings](../../../images/platform/kms/aws/encryption-project-settings.png)
</Step>
<Step title="Under the Key Management section, select your newly added AWS KMS key from the dropdown">
![Select encryption project
settings](../../../images/platform/kms/aws/encryption-project-settings-select.png)
Choose the AWS KMS key you configured earlier.
</Step>
<Step title="Click Save">
Save the changes to apply the new encryption settings to your project.
</Step>
</Steps>

28
docs/documentation/platform/kms/overview.mdx Normal file
View File

@@ -0,0 +1,28 @@
---
title: "Key Management Service (KMS)"
sidebarTitle: "Overview"
description: "Learn how to configure your project's encryption"
---
## Introduction
Infisical leverages a Key Management Service (KMS) to securely encrypt and decrypt secrets in your projects.
## Overview
Infisical's KMS ensures the security of your project's secrets through the following mechanisms:
- Each project is assigned a unique workspace key, which is responsible for encrypting and decrypting secret values.
- The workspace key itself is encrypted using the project's configured KMS.
- When secrets are requested, the workspace key is derived from the configured KMS. This key is then used to decrypt the secret values on-demand before sending them to the requesting client.
## Configuration
You can set the KMS for new projects during project creation.
![Configure KMS new](../../../images/platform/kms/configure-kms-new.png)
For existing projects, you can configure the KMS from the Project Settings page.
![Configure KMS existing](../../../images/platform/kms/configure-kms-existing.png)
## External KMS
Infisical supports the use of external KMS solutions to enhance security and compliance. You can configure your project to use services like [AWS Key Management Service](./aws-kms) for managing encryption.