允许 MWAA 使用内置 AWS KMS 密钥的 IAM 策略将密钥指定为“NotResource”以正常工作答案

【问题标题】：IAM policy to allow MWAA to use built in AWS KMS key specifies key as "NotResource" to work correctly允许 MWAA 使用内置 AWS KMS 密钥的 IAM 策略将密钥指定为“NotResource”以正常工作
【发布时间】：2022-10-21 16:33:48
【问题描述】：

我在理解一些与 MWAA 和 KMS 相关的 IAM 策略语法时遇到了一些麻烦，我想知道是否有人可以帮助我理解。

从这个文档：

https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-create-role.html

最后，有一些策略允许 MWAA 的角色能够使用内置的 AWS KMS 密钥。

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "airflow:PublishMetrics",
            "Resource": "arn:aws:airflow:{your-region}:{your-account-id}:environment/{your-environment-name}"
        },
        { 
            "Effect": "Deny",
            "Action": "s3:ListAllMyBuckets",
            "Resource": [
                "arn:aws:s3:::{your-s3-bucket-name}",
                "arn:aws:s3:::{your-s3-bucket-name}/*"
            ]
        },
        { 
            "Effect": "Allow",
            "Action": [ 
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
            ],
            "Resource": [
                "arn:aws:s3:::{your-s3-bucket-name}",
                "arn:aws:s3:::{your-s3-bucket-name}/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:CreateLogGroup",
                "logs:PutLogEvents",
                "logs:GetLogEvents",
                "logs:GetLogRecord",
                "logs:GetLogGroupFields",
                "logs:GetQueryResults"
            ],
            "Resource": [
                "arn:aws:logs:{your-region}:{your-account-id}:log-group:airflow-{your-environment-name}-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetAccountPublicAccessBlock"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "cloudwatch:PutMetricData",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sqs:ChangeMessageVisibility",
                "sqs:DeleteMessage",
                "sqs:GetQueueAttributes",
                "sqs:GetQueueUrl",
                "sqs:ReceiveMessage",
                "sqs:SendMessage"
            ],
            "Resource": "arn:aws:sqs:{your-region}:*:airflow-celery-*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:GenerateDataKey*",
                "kms:Encrypt"
            ],
            "NotResource": "arn:aws:kms:*:{your-account-id}:key/*",
            "Condition": {
                "StringLike": {
                    "kms:ViaService": [
                        "sqs.{your-region}.amazonaws.com"
                    ]
                }
            }
        }
    ]
}

I am not understanding this last block.

It's an 'Allow' action.
It contains KMS actions.

But I don't understand why the key is "NotResource" ?

The key listed is the one we want to allow, so why does this seem backwards?

Anyone able to word the logic to help me understand this?

Many thanks

【问题讨论】：

标签： amazon-iam amazon-kms mwaa aws-iam-policy

【解决方案1】：

示例策略适用于“AWS 拥有的密钥”。现在，AWS owned keys 是 AWS 服务拥有且不在您的 AWS 账户中的 KMS 密钥的集合。因此，策略声明 "NotResource": "arn:aws:kms:*:{your-account-id}:key/*" 暗示允许在策略中为不在您的 AWS 账户中的任何 KMS 资源指定的操作，例如AWS 拥有的密钥（前提是密钥所有者授予您访问权限）以及何时通过 SQS 服务使用。

【讨论】：