awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

improvement: finish address changes

Browse Source
This commit is contained in:
Scott Wilson
2024-10-02 16:35:53 -07:00
parent fd254fbeec
commit e667c7c988
82 changed files with 2708 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files

82
docs/documentation/platform/kms-configuration/aws-hsm.mdx Normal file
View File

@@ -0,0 +1,82 @@
---
title: "AWS CloudHSM"
description: "Learn how to manage encryption using AWS CloudHSM"
---
This guide provides instructions on securing Infisical project secrets using AWS CloudHSM.
Integration with AWS CloudHSM is achieved by configuring it as a custom key store for AWS KMS.
Follow the steps below to set up AWS KMS with AWS CloudHSM as the custom key store.
## Prepare AWS CloudHSM Cluster
Before you get started, you'll need to configure a AWS CloudHSM cluster which meets the following criteria:
- The cluster must be active.
- The cluster must not be associated with any other AWS KMS custom key store.
- The cluster must be configured with private subnets in at least two Availability Zones in the Region.
- The security group for the cluster must include inbound and outbound rules that allow TCP traffic on ports 2223-2225.
- The cluster must contain at least two active HSMs in different Availability Zones.
For more details on setting up your cluster, refer to the following [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore).
## Set Up AWS KMS Custom Key Store
To set up an AWS KMS custom key store with AWS CloudHSM, you will need the following:
- The trust anchor certificate of your AWS CloudHSM cluster.
- A `kmsuser` user in the AWS CloudHSM cluster with the crypto-user role.
<Steps>
<Step title="Navigate to Key store creation page">
In the AWS console, head over to `AWS KMS` > `AWS CloudHSM key stores` and click **Create key store**.
</Step>
<Step title="Add key store name">
Input the custom key store name. ![Set key store name](../../../images/platform/kms/aws-hsm/create-key-store-name.png)
</Step>
<Step title="Select HSM cluster">
Select the AWS CloudHSM cluster. You should be able to select the cluster if it meets the required criteria mentioned above.
![Set key store cluster](../../../images/platform/kms/aws-hsm/create-key-store-cluster.png)
</Step>
<Step title="Upload trust anchor certificate">
Upload your CloudHSM's cluster trust anchor certificate file.
![Set key store cert](../../../images/platform/kms/aws-hsm/create-key-store-cert.png)
</Step>
<Step title="Provide cluster user password">
Input the password of the `kmsuser` crypto-user in your cluster.
![Set key store password](../../../images/platform/kms/aws-hsm/create-key-store-password.png)
</Step>
<Step title="Finish key store creation">
Proceed with creating the AWS CloudHSM key store.
</Step>
</Steps>
For more details, refer to the following [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#create-keystore-console).
## Create AWS KMS Key
Next, you'll need to create a AWS KMS key where you will set the key store you created previously.
<Steps>
<Step title="Navigate to AWS KMS key creation page">
In your AWS console, proceed to `AWS KMS` > `Customer managed keys` and click **Create**.
</Step>
<Step title="Set key options">
Set Key type to `Symmetric` and Key usage to `Encrypt and decrypt`.
![Set key options 1](../../../images/platform/kms/aws-hsm/create-kms-key-1.png)
</Step>
<Step title="Select key material origin">
In the advanced options, for the Key material origin field, select `AWS CloudHSM key store`. Then, click next.
![Set key options 2](../../../images/platform/kms/aws-hsm/create-kms-key-2.png)
</Step>
<Step title="Choose key store">
Select the AWS CloudHSM key store you created earlier.
![Select HSM 1](../../../images/platform/kms/aws-hsm/create-kms-select-hsm.png)
</Step>
<Step title="Finish KMS key creation">
Proceed with creating the AWS KMS Key.
</Step>
</Steps>
## Connect Infisical to AWS KMS Key
You should now have an AWS KMS that has a custom key store set to AWS CloudHSM.
To secure project resources, you will need to add this AWS KMS to your Infisical organization. To learn how, refer to the documentation [here](./aws-kms).

151
docs/documentation/platform/kms-configuration/aws-kms.mdx Normal file
View File

@@ -0,0 +1,151 @@
---
title: "AWS Key Management Service"
description: "Learn how to manage encryption using AWS KMS"
---
To enhance the security of your Infisical projects, you can now encrypt your secrets using an external Key Management Service (KMS).
When external KMS is configured for your project, all encryption and decryption operations will be handled by the chosen KMS.
This guide will walk you through the steps needed to configure external KMS support with AWS KMS.
## Prerequisites
Before you begin, you'll first need to choose a method of authentication with AWS from below.
<Tabs>
<Tab title="Method 1: Assume Role (Recommended)">
<Steps>
<Step title="Create the Managing User IAM Role">
1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
![IAM Role Creation](/images/integrations/aws/integration-aws-iam-assume-role.png)
2. Select **AWS Account** as the **Trusted Entity Type**.
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If you are self-hosting, provide the AWS account number where Infisical is hosted.
4. Optionally, enable **Require external ID** and enter your Infisical **project ID** to further enhance security.
</Step>
<Step title="Add Required Permissions for the IAM Role">
Use the following custom policy to grant the minimum permissions required by Infisical to integrate with AWS KMS
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKMSAccess",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:DescribeKey"
],
"Resource": "*"
}
]
}
```
</Step>
</Steps>
</Tab>
<Tab title="Method 2: Access Key">
Navigate to your IAM user and add a policy to grant the following permissions:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKMSAccess",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:DescribeKey"
],
"Resource": "*"
}
]
}
```
</Tab>
</Tabs>
## Setup AWS KMS in the Organization Settings
Next, you will need to follow the steps listed below to add AWS KMS for your organization.
<Steps>
<Step title="Navigate to the organization settings and select the 'Encryption' tab.">
![Open encryption org settings](../../../images/platform/kms/aws/encryption-org-settings.png)
</Step>
<Step title="Click on the 'Add' button">
![Add encryption org settings](../../../images/platform/kms/aws/encryption-org-settings-add.png)
Click the 'Add' button to begin adding a new external KMS.
</Step>
<Step title="Select 'AWS KMS'">
![Select Encryption Provider](../../../images/platform/kms/aws/encryption-modal-provider-select.png)
Choose 'AWS KMS' from the list of encryption providers.
</Step>
<Step title="Provide the inputs for AWS KMS">
Selecting AWS as the provider will require you input the following fields.
<ParamField path="Alias" type="string" required>
Name for referencing the AWS KMS key within the organization.
</ParamField>
<ParamField path="Description" type="string">
Short description of the AWS KMS key.
</ParamField>
<ParamField path="Authentication Mode" type="string" required>
Authentication mode for AWS, either "AWS Assume Role" or "Access Key".
</ParamField>
<ParamField path="IAM Role ARN For Role Assumption" type="string">
ARN of the AWS role to assume for providing Infisical access to the AWS KMS Key (required if Authentication Mode is "AWS Assume Role")
</ParamField>
<ParamField path="Assume Role External ID" type="string">
Custom identifier for additional validation during role assumption.
</ParamField>
<ParamField path="Access Key ID" type="string">
AWS IAM Access Key ID for authentication (required if Authentication Mode is "Access Key").
</ParamField>
<ParamField path="Secret Access Key" type="string">
AWS IAM Secret Access Key for authentication (required if Authentication Mode is "Access Key").
</ParamField>
<ParamField path="AWS Region" type="string" required>
AWS region where the AWS KMS Key is located.
</ParamField>
<ParamField path="AWS KMS Key ID" type="string">
Key ID of the AWS KMS Key. If left blank, Infisical will generate and use a new AWS KMS Key in the specified region.
![AWS KMS key ID](../../../images/platform/kms/aws/aws-kms-key-id.png)
</ParamField>
</Step>
<Step title="Click Save">
Save your configuration to apply the settings.
</Step>
</Steps>
You now have an AWS KMS Key configured at the organization level. You can assign these AWS KMS keys to existing Infisical projects by visiting the 'Project Settings' page.
## Assign AWS KMS Key to an Existing Project
To assign the AWS KMS key you added to your organization, follow the steps below.
<Steps>
<Step title="Open Project Settings and select to the Encryption Tab">
![Open encryption project
settings](../../../images/platform/kms/aws/encryption-project-settings.png)
</Step>
<Step title="Under the Key Management section, select your newly added AWS KMS key from the dropdown">
![Select encryption project
settings](../../../images/platform/kms/aws/encryption-project-settings-select.png)
Choose the AWS KMS key you configured earlier.
</Step>
<Step title="Click Save">
Once you have selected the KMS of choice, click save.
</Step>
</Steps>

33
docs/documentation/platform/kms-configuration/overview.mdx Normal file
View File

@@ -0,0 +1,33 @@
---
title: "Key Management Service (KMS) Configuration"
sidebarTitle: "Overview"
description: "Learn how to configure your project's encryption"
---
## Introduction
Infisical leverages a Key Management Service (KMS) to securely encrypt and decrypt secrets in your projects.
## Overview
Infisical's KMS ensures the security of your project's secrets through the following mechanisms:
- Each project is assigned a unique workspace key, which is responsible for encrypting and decrypting secret values.
- The workspace key itself is encrypted using the project's configured KMS.
- When secrets are requested, the workspace key is derived from the configured KMS. This key is then used to decrypt the secret values on-demand before sending them to the requesting client.
## Configuration
You can set the KMS for new projects during project creation.
![Configure KMS new](../../../images/platform/kms/configure-kms-new.png)
For existing projects, you can configure the KMS from the Project Settings page.
![Configure KMS existing](../../../images/platform/kms/configure-kms-existing.png)
## External KMS
Infisical supports the use of external KMS solutions to enhance security and compliance. You can configure your project to use services like [AWS Key Management Service](./aws-kms) for managing encryption.
## Infisical KMS
Infisical exposes it's internal KMS solution, [Infisical KMS](../kms), enabling you to create and manage keys to perform cryptographic operations with.