Aws kms #120
Aws kms #120
Conversation
|
@omerlh |
|
|
||
| We look forward to add support for other cloud solutions, like AWS KMS. |
There was a problem hiding this comment.
Maybe keep this section just say "add support for other solutions, like HSM"?
| Using [AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html) as the key managment solution is the secure solution when running a cluster on AWS Cloud. | ||
| There are 2 options to authentication with the KMS: | ||
| 1. Kamus by default will try to use the regular AWS SDK discovery mechinisem, if your cluster in AWS you need to map IAM role to kamus POD by using one of the community tools, for example [kiam](https://github.com/uswitch/kiam). | ||
| 2. Provide user access key and secret with KMS access. |
There was a problem hiding this comment.
Add a quick note on what is required when initializing KMS?
There was a problem hiding this comment.
Also, maybe add a note on the required IAM permissions for Kamus?
There was a problem hiding this comment.
Can you elaborate? I can't think of anything required other than permissions to KMS.
There was a problem hiding this comment.
My bad, you're right. Just specify the IAM role?
There was a problem hiding this comment.
I've added below that the required IAM role/user permissions for kamus to work properly is full KMS access.
| Using [AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html) as the key managment solution is the secure solution when running a cluster on AWS Cloud. | ||
| There are 2 options to authentication with the KMS: | ||
| 1. Kamus by default will try to use the regular AWS SDK discovery mechinisem, if your cluster in AWS you need to map IAM role to kamus POD by using one of the community tools, for example [kiam](https://github.com/uswitch/kiam). | ||
| 2. Provide user access key and secret with KMS access. |
There was a problem hiding this comment.
Also, maybe add a note on the required IAM permissions for Kamus?
|
Don't forget to bump the version of the API in the CSPROJ :) |
Closes #60