elastic beanstalk 无法读取密钥管理系统密钥

Question

我正在使用弹性 beanstalk 来运行我的服务器并将密钥存储在密钥管理系统中。

我可以在本地访问 KMS，并且可以确认它们内部拥有正确的密钥，并且本地系统运行良好。但是，当我将其上传到弹性 beantalk 时，它无法检索密钥并出现以下错误。

Jul 31 18:42:31 ip-10-1-0-199 web: (node:8766) UnhandledPromiseRejectionWarning: Error: Unable to decrypt data key and one or more KMS CMKs had an error.
Jul 31 18:42:31 ip-10-1-0-199 web: Error #1
Jul 31 18:42:31 ip-10-1-0-199 web: AccessDeniedException: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.

由于它在本地工作，因此密钥确实存在。而且由于它们位于同一区域，因此也消除了该区域。所以我假设它是or you are not allowed to access。但我不确定如何检查这个，甚至不知道如何授予对我的弹性 beanstalk 应用程序的访问权限。

有人知道如何通过弹性 beanstalk 应用授予对 KMS 的访问权限吗？ （我假设这是问题所在）

这里是我的代码当前如何提取信息的参考，以供参考

// This is an async function that runs only on startup
// There is a potential chance that on first startup a user could call the server
// and the server still have local/dev credentials
// Should think of a solution for this
if(
    Environment === Environments.Production || 
    Environment === Environments.Release || 
    Environment === Environments.Development
  ){
  Config.Aws.BucketName = process.env.bucketName;
  Config.Aws.BucketFilePath = process.env.bucketFilePath;
}

let useKms = true;
if(
    Environment === Environments.Production || 
    Environment === Environments.Release || 
    Environment === Environments.Development
  ){
  useKms = true;
}


if(useKms && Config.Aws.BucketName !== "" && Config.Aws.BucketFilePath !== ""){
  try{
    var getParams = {
      Bucket: Config.Aws.BucketName, 
      Key: Config.Aws.BucketFilePath, 
    }

    console.log("getParams",getParams);

    s3.getObject(getParams, async function(err, data) {
      // Handle any error and exit
      // Need to properly handle this error
      if (err){
        console.log("err",err);
        return false;
      }
      // No error happened
      // Convert Body from a Buffer to a String
      let objectData = data.Body.toString('utf-8'); // Use the encoding necessary
      // Eval is safe to use here since we know what is saved in S3
      let BucketKeys = eval(objectData);

      let keyIds = BucketKeys.AwsKeyIds;

      const keyring = new KmsKeyringNode({ keyIds });
      let result = Buffer.from(JSON.parse(BucketKeys.BufferString).data);
      const { plaintext } = await decrypt(keyring,result);

      let foo = plaintext.toString('utf8');
      let KmsObject = JSON.parse(foo);

      Config.Db.Hostname = KmsObject.DatabaseHost;
      Config.Db.Username = KmsObject.DatabaseUsername;
      Config.Db.Password = KmsObject.DatabasePassword;
      Config.Db.Name = KmsObject.DatabaseName;
      Config.Db.Port = KmsObject.DatabasePort;

      Config.Keys.ApiKey = KmsObject.ApiKey;
      Config.Keys.ClientId = KmsObject.ClientId;
      Config.Keys.FetchTokenUsername = KmsObject.FetchTokenUsername;
      Config.Keys.FetchTokenPassword = KmsObject.FetchTokenPassword;
      
      Config.Keys.GoogleClientId = KmsObject.GoogleClientId;
      Config.Keys.GoogleClientSecret = KmsObject.GoogleClientSecret;
      Config.Keys.FacebookAppId = KmsObject.FacebookAppId;
      Config.Keys.FacebookAppSecret = KmsObject.FacebookAppSecret;

      Config.Keys.PaypalApiUrl = "https://api.paypal.com";
      Config.Keys.PaypalClientId = KmsObject.PaypalClientId;
      Config.Keys.PaypalSecret = KmsObject.PaypalSecret;

      Config.Keys.StripePublicKey = KmsObject.StripePublicKey;
      Config.Keys.StripeSecretKey = KmsObject.StripeSecretKey;

      Config.Email.Host = KmsObject.EmailHost;
      Config.Email.Port = KmsObject.EmailPort;
      Config.Email.Secure = false;
      Config.Email.User = KmsObject.EmailUser;
      Config.Email.Pass = KmsObject.EmailPass;
      Config.Email.From = "Server";

    });
  }catch(e){
    console.log("tried KMS. but errored out");
  }
}

Answer 1

但我不确定如何检查这个，甚至不知道如何授予对我的弹性 beanstalk 应用程序的访问权限。

要使您的 EB 实例能够访问以使用您的 KMS，您必须明确允许。

这是通过key policies 完成的。具体来说，您可以将您的 EB 实例角色添加为关键用户。要检查您的 CMK 访问权限，您还需要检查密钥策略。

在 KMS 控制台中，要为您的 EB 实例添加使用密钥的权限，您可以将实例角色的 ARN（或名称）添加到密钥策略中：