AWS系统会话管理器对加密CloudWatch日志组的KMS权限

Question

我已经设置了一个CMK（自定义托管密钥）来使用AWS系统会话管理器加密日志组：

>

首先，在KMS控制台中添加“密钥管理员”和“密钥用户/角色”的权限。

接下来,CMK将在AWS系统管理器会话管理器首选项中附加到日志组,如图所示：

密钥必须存在，因为它用于加密会话，只是不能正确解密日志组，但它链接到日志组并且用户有权限。什么给了？

Answer 1

我试图复制你的问题。

我的会话管理器设置：

CloudWatch日志组已使用CLI：

{
    "logGroups": [
        {
            "logGroupName": "SSM",
            "creationTime": 1593579430258,
            "metricFilterCount": 0,
            "arn": "arn:aws:logs:us-east-1:xxxxx:log-group:SSM:*",
            "storedBytes": 0,
            "kmsKeyId": "arn:aws:kms:us-east-1:xxxxxxxxx:key/xxxx-9500-xxxxx"
        }
    ]
}

{
    "Effect": "Allow",
    "Principal": {
        "Service": "logs.us-east-1.amazonaws.com"
    },
    "Action": [
        "kms:Encrypt*",
        "kms:Decrypt*",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Describe*"
    ],
    "Resource": "*",
    "Condition": {
        "ArnLike": {
            "kms:EncryptionContext:aws:logs:arn": "arn:aws:logs:us-east-1:xxxxx:log-group:SSM"
        }
    }
},    
{
    "Effect": "Allow",
    "Principal": {
        "Service": "ssm.amazonaws.com"
    },
    "Action": [
        "kms:Encrypt*",
        "kms:Decrypt*",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Describe*"
    ],
    "Resource": "*"            
}, 
{
    "Effect": "Allow",    
    "Action": [
        "kms:Encrypt*",
        "kms:Decrypt*",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Describe*"
    ],
    "Resource": "*",
    "Principal": {
        "AWS": "arn:aws:iam::xxxxx:role/SSMRole"
    }      
}