InfoScale™ 9.0 Storage Foundation Administrator's Guide - Linux

To configure the AWS KMS service on the cloud provider:

1. Create an IAM policy for the KMS operations.

   Create an IAM policy, for example InfoScaleKMSPolicy that grants permissions for the following operations:

   • CreateKey

   • ScheduleKeyDeletion

   • GenerateDataKey

   • Encrypt

   • Decrypt

   • AssumeRole

   The policy should follow the principle of least privilege, granting only the necessary admin operations.

   The following example shows the IAM policy with the required permissions:

   { 
   
     "Version": "2012-10-17", 
   
     "Statement": [ 
   
       { 
         "Effect": "Allow", 
   
         "Action": [ 
   
           "kms:CreateKey", 
   
           "kms:CreateAlias", 
   
           "kms:ScheduleKeyDeletion", 
   
           "kms:GenerateDataKey", 
   
           "kms:Encrypt", 
   
           "kms:Decrypt", 
   
           "sts:AssumeRole" 
         ], 
   
         "Resource": "*" 
       } 
     ] 
   } 

   Create the IAMpPolicy in the AWS Management Console:

   • Go to the IAM Console and click Policies > Create Policy.

   • Choose JSON and paste the policy shown above.

   • Review and name the policy (for example: InfoScaleKMSPolicy).

   • Click Create policy.

2. Create an IAM role:

   • Create a new KMS role.

   • Map the policy created step to this role.

   • Update the trust relationship by adding 1 the below entry in statement section of Trust relationship :

      "Principal": { 
     
                     "Service": "ec2.amazonaws.com"                                                                               
     
                 }, 

   • Save the name of the newly created IAM role for KMS.

To configure InfoScale EC2 Instance for the KMS service:

1. Update IAM role of the EC2 instance:

   • In the navigation pane, click Instances.

   • Select the instance.

   • Click Actions > Security > Modify IAM role.

   • For the IAM role, select the IAM instance profile.

   • Choose the Update IAM role with the new KMS role that you created in step 2.

2. Update the cloudkmsclient.yaml configuration file.

   The storage admin needs to update the /etc/vx/cloudkmsclient.yaml file with the required information. Root-level permissions are required to edit this configuration file.

   The following example shows a sample YAML configuration file. The parameters for which you need to specify the values are highlighted in bold:

   global: 
   
     # The cloud KMS provider to use (Valid options are "aws", "azure") 
   
     cloud_kms_provider: "aws" 
   
     # Logging level (e.g., 'INFO', 'DEBUG', 'ERROR') 
   
     log_level: "INFO" 
   
    
   
   # Configuration for specific cloud providers 
   
   cloud_providers: 
   
     aws: 
   
       # Region name where KMS service is hosted. e.g. "us-east-1" 
   
       region: "us-east-1" 
   
       # InfoScale user (IAM) information 
   
       aws_account_id: "" 
   
       access_key: "" 
   
       secret_key: "" 
   
       # Name of KMS Specific role to be assumed having appropriate kms permissions 
   
       role_name: "" 
   
       # Set is_ec2_instance to True when Infoscale is running in EC2 
   
       is_ec2_instance: True 
   
       fips: False 
   
     azure: 
   
       # Set is_azure_instance to True when Infoscale is running in Azure instance 
   
       is_azure_instance: False 
   
       # Azure key vault name (globally unique), not URI 
   
       key_vault_name: "" 
   
       # Azure client ID for authentication 
   
       client_id: "" 
   
       # Azure client secret for authentication 
   
       client_secret: "" 
   
       # Azure tenant ID for authentication 
   
       tenant_id: "" 
   
       fips: False 

3. Verify the configuration. After updating the YAML file, run the below command on InfoScale hosts to check if the configuration is done correctly. If InfoScale is deployed in cluster mode, the admin must ensure that all the cluster nodes have the same configuration file.

   # vxencrypt -t cloudkms configure -- dryrun