选择您的 Cookie 首选项

我们使用必要 Cookie 和类似工具提供我们的网站和服务。我们使用性能 Cookie 收集匿名统计数据,以便我们可以了解客户如何使用我们的网站并进行改进。必要 Cookie 无法停用,但您可以单击“自定义”或“拒绝”来拒绝性能 Cookie。

如果您同意,AWS 和经批准的第三方还将使用 Cookie 提供有用的网站功能、记住您的首选项并显示相关内容,包括相关广告。要接受或拒绝所有非必要 Cookie,请单击“接受”或“拒绝”。要做出更详细的选择,请单击“自定义”。

监控 Amazon Bedrock 服务的加密密钥

聚焦模式
监控 Amazon Bedrock 服务的加密密钥 - Amazon Bedrock

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

当您将 AWS KMS 客户托管密钥与您的 Amazon Bedrock 资源一起使用时,您可以使用AWS CloudTrailAmazon CloudWatch Logs 来跟踪 Amaz on Bedrock 向其发送的请求。 AWS KMS

以下是 Amazon Bedrock CreateGrant为创建主拨款而调用的监控 AWS KMS 操作的示例 AWS CloudTrail 事件:

{ "eventVersion": "1.09", "userIdentity": { "type": "AssumedRole", "principalId": "AROAIGDTESTANDEXAMPLE:SampleUser01", "arn": "arn:aws:sts::111122223333:assumed-role/RoleForModelImport/SampleUser01", "accountId": "111122223333", "accessKeyId": "EXAMPLE", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "AROAIGDTESTANDEXAMPLE", "arn": "arn:aws:iam::111122223333:role/RoleForModelImport", "accountId": "111122223333", "userName": "RoleForModelImport" }, "attributes": { "creationDate": "2024-05-07T21:46:28Z", "mfaAuthenticated": "false" } }, "invokedBy": "bedrock.amazonaws.com" }, "eventTime": "2024-05-07T21:49:44Z", "eventSource": "kms.amazonaws.com", "eventName": "CreateGrant", "awsRegion": "us-east-1", "sourceIPAddress": "bedrock.amazonaws.com", "userAgent": "bedrock.amazonaws.com", "requestParameters": { "granteePrincipal": "bedrock.amazonaws.com", "retiringPrincipal": "bedrock.amazonaws.com", "keyId": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE", "operations": [ "Decrypt", "CreateGrant", "GenerateDataKey", "DescribeKey" ] }, "responseElements": { "grantId": "0ab0ac0d0b000f00ea00cc0a0e00fc00bce000c000f0000000c0bc0a0000aaafSAMPLE", "keyId": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE" }, "requestID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE", "eventID": "ff000af-00eb-00ce-0e00-ea000fb0fba0SAMPLE", "readOnly": false, "resources": [ { "accountId": "111122223333", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE" } ], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management" }

按照创建策略中的步骤,将以下基于资源的策略附加到 KMS 密钥。该策略包含两个语句。

  1. 角色对模型自定义构件进行加密的权限。将导入 ARNs 的自定义模型构建器角色添加到该Principal字段。

  2. 角色在推理中使用导入的自定义模型的权限。将导入 ARNs 的自定义模型用户角色添加到该Principal字段。

{ "Version": "2012-10-17", "Id": "KMS Key Policy", "Statement": [ { "Sid": "Permissions for imported model builders", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::account-id:user/role" }, "Action": [ "kms:Decrypt", "kms:GenerateDataKey", "kms:DescribeKey", "kms:CreateGrant" ], "Resource": "*" }, { "Sid": "Permissions for imported model users", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::account-id:user/role" }, "Action": "kms:Decrypt", "Resource": "*" } }
隐私网站条款Cookie 首选项
© 2025, Amazon Web Services, Inc. 或其附属公司。保留所有权利。