diff --git a/docs/documentation/platform/kms/aws-kms.mdx b/docs/documentation/platform/kms/aws-kms.mdx new file mode 100644 index 000000000..9a546b277 --- /dev/null +++ b/docs/documentation/platform/kms/aws-kms.mdx @@ -0,0 +1,87 @@ +--- +title: "AWS Key Management Service (KMS)" +description: "Learn how to manage encryption using AWS KMS" +--- + +You can configure your projects to use AWS KMS keys for encryption, enhancing the security and management of your secrets. + +## Setup AWS KMS in the Organization Settings + +Follow these steps to set up AWS KMS for your organization: + + + + ![Open encryption org settings](../../../images/platform/kms/aws/encryption-org-settings.png) + + + ![Add encryption org settings](../../../images/platform/kms/aws/encryption-org-settings-add.png) + Click the 'Add' button to begin adding a new external KMS. + + + ![Select Encryption Provider](../../../images/platform/kms/aws/encryption-modal-provider-select.png) + Choose 'AWS KMS' from the list of encryption providers. + + + Fill in the required details for AWS KMS: + + Name for referencing the AWS KMS key within the organization. + + + + Short description of the AWS KMS key. + + + + Authentication mode for AWS, either "AWS Assume Role" or "Access Key". + + + + ARN of the AWS role to assume for providing Infisical access to the AWS KMS Key (required if Authentication Mode is "AWS Assume Role") + + + + Custom identifier for additional validation during role assumption. + + + + AWS IAM Access Key ID for authentication (required if Authentication Mode is "Access Key"). + + + + AWS IAM Secret Access Key for authentication (required if Authentication Mode is "Access Key"). + + + + AWS region where the AWS KMS Key is located. + + + Key ID of the AWS KMS Key. If left blank, Infisical will generate and use a new AWS KMS Key in the specified region. + ![AWS KMS key ID](../../../images/platform/kms/aws/aws-kms-key-id.png) + + + + + Save your configuration to apply the settings. + + + +You now have an AWS KMS Key configured at the organization level. You can assign these keys to existing projects via the Project Settings page. + +## Assign AWS KMS Key to an Existing Project + +Follow these steps to assign an AWS KMS key to a project: + + + + ![Open encryption project + settings](../../../images/platform/kms/aws/encryption-project-settings.png) + + + ![Select encryption project + settings](../../../images/platform/kms/aws/encryption-project-settings-select.png) + Choose the AWS KMS key you configured earlier. + + + Save the changes to apply the new encryption settings to your project. + + diff --git a/docs/documentation/platform/kms/overview.mdx b/docs/documentation/platform/kms/overview.mdx new file mode 100644 index 000000000..99cfa134f --- /dev/null +++ b/docs/documentation/platform/kms/overview.mdx @@ -0,0 +1,28 @@ +--- +title: "Key Management Service (KMS)" +sidebarTitle: "Overview" +description: "Learn how to configure your project's encryption" +--- + +## Introduction + +Infisical leverages a Key Management Service (KMS) to securely encrypt and decrypt secrets in your projects. + +## Overview + +Infisical's KMS ensures the security of your project's secrets through the following mechanisms: + +- Each project is assigned a unique workspace key, which is responsible for encrypting and decrypting secret values. +- The workspace key itself is encrypted using the project's configured KMS. +- When secrets are requested, the workspace key is derived from the configured KMS. This key is then used to decrypt the secret values on-demand before sending them to the requesting client. + +## Configuration + +You can set the KMS for new projects during project creation. +![Configure KMS new](../../../images/platform/kms/configure-kms-new.png) +For existing projects, you can configure the KMS from the Project Settings page. +![Configure KMS existing](../../../images/platform/kms/configure-kms-existing.png) + +## External KMS + +Infisical supports the use of external KMS solutions to enhance security and compliance. You can configure your project to use services like [AWS Key Management Service](./aws-kms) for managing encryption. diff --git a/docs/images/platform/kms/aws/aws-kms-key-id.png b/docs/images/platform/kms/aws/aws-kms-key-id.png new file mode 100644 index 000000000..ddeac5093 Binary files /dev/null and b/docs/images/platform/kms/aws/aws-kms-key-id.png differ diff --git a/docs/images/platform/kms/aws/encryption-modal-provider-select.png b/docs/images/platform/kms/aws/encryption-modal-provider-select.png new file mode 100644 index 000000000..704043a74 Binary files /dev/null and b/docs/images/platform/kms/aws/encryption-modal-provider-select.png differ diff --git a/docs/images/platform/kms/aws/encryption-org-settings-add.png b/docs/images/platform/kms/aws/encryption-org-settings-add.png new file mode 100644 index 000000000..03c9a3eaa Binary files /dev/null and b/docs/images/platform/kms/aws/encryption-org-settings-add.png differ diff --git a/docs/images/platform/kms/aws/encryption-org-settings.png b/docs/images/platform/kms/aws/encryption-org-settings.png new file mode 100644 index 000000000..b413cd321 Binary files /dev/null and b/docs/images/platform/kms/aws/encryption-org-settings.png differ diff --git a/docs/images/platform/kms/aws/encryption-project-settings-select.png b/docs/images/platform/kms/aws/encryption-project-settings-select.png new file mode 100644 index 000000000..a6323bcb3 Binary files /dev/null and b/docs/images/platform/kms/aws/encryption-project-settings-select.png differ diff --git a/docs/images/platform/kms/aws/encryption-project-settings.png b/docs/images/platform/kms/aws/encryption-project-settings.png new file mode 100644 index 000000000..1df97abae Binary files /dev/null and b/docs/images/platform/kms/aws/encryption-project-settings.png differ diff --git a/docs/images/platform/kms/configure-kms-existing.png b/docs/images/platform/kms/configure-kms-existing.png new file mode 100644 index 000000000..8d26724aa Binary files /dev/null and b/docs/images/platform/kms/configure-kms-existing.png differ diff --git a/docs/images/platform/kms/configure-kms-new.png b/docs/images/platform/kms/configure-kms-new.png new file mode 100644 index 000000000..e18bb227c Binary files /dev/null and b/docs/images/platform/kms/configure-kms-new.png differ diff --git a/docs/mint.json b/docs/mint.json index 6628316f8..5c7012745 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -154,6 +154,13 @@ "documentation/platform/dynamic-secrets/aws-iam" ] }, + { + "group": "Key Management", + "pages": [ + "documentation/platform/kms/overview", + "documentation/platform/kms/aws-kms" + ] + }, "documentation/platform/secret-sharing" ] },