AWS KMS 之 EBS 和 S3 加密最佳实践

{    "Id": "key-consolepolicy-3",    "Version": "2012-10-17",    "Statement": [        {            "Sid": "Enable IAM User Permissions",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::AccountID:root"            },            "Action": "kms:*",            "Resource": "*"        },        {            "Sid": "Allow access for Key Administrators",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam:: AccountID:user/awsent"            },            "Action": [                "kms:Create*",                "kms:Describe*",                "kms:Enable*",                "kms:List*",                "kms:Put*",                "kms:Update*",                "kms:Revoke*",                "kms:Disable*",                "kms:Get*",                "kms:Delete*",                "kms:TagResource",                "kms:UntagResource",                "kms:ScheduleKeyDeletion",                "kms:CancelKeyDeletion"            ],            "Resource": "*"        },        {            "Sid": "Allow use of the key",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam:: AccountID:user/awsent"            },            "Action": [                "kms:Encrypt",                "kms:Decrypt",                "kms:ReEncrypt*",                "kms:GenerateDataKey*",                "kms:DescribeKey"            ],            "Resource": "*"        },        {            "Sid": "Allow attachment of persistent resources",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam:: AccountID:user/awsent"            },            "Action": [                "kms:CreateGrant",                "kms:ListGrants",                "kms:RevokeGrant"            ],            "Resource": "*",            "Condition": {                "Bool": {                    "kms:GrantIsForAWSResource": "true"                }            }        }    ]}

### [](https://amazonaws-china.com/cn/blogs/china/tag/%E7%BD%97%E4%BF%8A/)
亚马逊 AWS 专业服务团队云架构咨询顾问。负责企业客户的云架构设计、迁移、安全和优化，云上自动化运维，容器等相关咨询服务。对云原生技术、区块链等有深入的研究和热情。