Encryption at rest with AWS Key Management Service

By default, AWS Network Firewall provides encryption for your data at rest using AWS owned keys to protect sensitive customer data. Or, you can use symmetric customer managed keys that you create, own, and manage to encrypt your data at rest.

For general information on AWS KMS, see What is AWS Key Management Service? in the AWS Key Management Service Developer Guide.

Using customer managed keys with Network Firewall

The following section provides information about using customer managed keys with Network Firewall.

How AWS Network Firewall uses grants in AWS KMS

Network Firewall requires a grant to use your customer managed key.

When you create a firewall, firewall policy, or rule group encrypted with a customer managed key, Network Firewall creates a grant on your behalf by sending a CreateGrant request to AWS KMS. Grants in AWS KMS are used to give Network Firewall access to a KMS key in a customer account.

Network Firewall requires the grant to use your customer managed key for the following internal operations:

Creating a customer managed key

You can create a symmetric customer managed key by using the AWS Management Console, or the AWS KMS APIs.

To create a symmetric customer managed key

Follow the steps for Creating symmetric customer managed key in the AWS Key Management Service Developer Guide.

Key policy

Key policies control access to your customer managed key. Every customer managed key must have exactly one key policy, which contains statements that determine who can use the key and how they can use it. When you create your customer managed key, you can specify a key policy. For more information, see Managing access to customer managed keys in the AWS Key Management Service Developer Guide.

To use your customer managed key with your Network Firewall resources, the following API operations must be permitted in the key policy:

The following are policy statement examples you can add for Network Firewall:

          {
    "Id": "key-consolepolicy-3",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow access for Key Administrators",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:role/Admin"
            },
            "Action": [
                "kms:Create*",
                "kms:Describe*",
                "kms:Enable*",
                "kms:List*",
                "kms:Put*",
                "kms:Update*",
                "kms:Revoke*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Delete*",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:ScheduleKeyDeletion",
                "kms:CancelKeyDeletion"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow use of the key",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:root"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow attachment of persistent resources",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:root"
            },
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        }
    ]
}
      

For information about specifying permissions in a policy, see the AWS Key Management Service Developer Guide. For more information about troubleshooting key access, see the AWS Key Management Service Developer Guide.

Specifying a customer managed key for Network Firewall

You can specify a customer managed key for the following resources:

When you create a resource, you can specify the data key by entering an AWS KMS ID, which Network Firewall uses to encrypt the identifiable personal data stored by the resource. An AWS KMS ID is a key identifier for an AWS KMS customer managed key. You can specify a key ID, key ARN, alias name, or alias ARN.

AWS Network Firewall encryption context

An encryption context is an optional set of key-value pairs that contain additional contextual information about the data. AWS KMS uses the encryption context as additional authenticated data to support authenticated encryption. When you include an encryption context in a request to encrypt data, AWS KMS binds the encryption context to the encrypted data. To decrypt data, you include the same encryption context in the request.

AWS Network Firewall encryption context

Network Firewall uses the same encryption context in all AWS KMS cryptographic operations, where the key is aws:network-firewall:resource-id and the value is the resource Amazon Resource Name (ARN).

"encryptionContext": {
    "aws:network-firewall:resource-id": "abcdef-b795-4280-8560-3c2b5e723c41"
}

Using encryption context for monitoring

When you use a symmetric customer managed key to encrypt your Network Firewall resources, you can also use the encryption context in audit records and logs to identify how the customer managed key is being used. The encryption context also appears in logs generated by AWS CloudTrail or Amazon CloudWatch Logs.

Using encryption context to control access to your customer managed key

You can use the encryption context in key policies and IAM policies as conditions to control access to your symmetric customer managed key. You can also use encryption context constraints in a grant.

Network Firewall uses an encryption context constraint in grants to control access to the customer managed key in your account or Region. The grant constraint requires that the operations that the grant allows use the specified encryption context.

{
    "KeyId": "arn:aws:kms:region:111122223333:key/1234abcd-12ab-34cd-56ef-123456SAMPLE",
    "GrantId": "grant_ID",
    "Name": "11223344-abcd-1111-2222-111222333444",
    "CreationDate": "2022-03-16T14:42:42-04:00",
    "GranteePrincipal": "network-firewall.region.amazonaws.com",
    "RetiringPrincipal": "network-firewall.region.amazonaws.com",
    "IssuingAccount": "111122223333",
    "Operations": [
        "Decrypt",
        "GenerateDataKey",
        "RetireGrant"
    ],
    "Constraints": {
        "EncryptionContextSubset": {
            "aws:network-firewall:resource-id": "11223344-aabb-1122-3344-111222333444"
        }
    }
}
    

Monitoring customer managed keys

When you use an AWS KMS customer managed key with your AWS Network Firewall resources, you can use AWS CloudTrail or Amazon CloudWatch Logs to track requests that Network Firewall sends to AWS KMS.

The following example is an AWS CloudTrail event for CreateGrant to monitor KMS operations called by Network Firewall to access data encrypted by your customer managed key:

When you use an AWS KMS customer managed key to encrypt your Network Firewall resources, Network Firewall sends a CreateGrant request on your behalf to access the KMS key in your AWS account. The grant that Network Firewall creates are specific to the resource associated with the AWS KMS customer managed key. In addition, Network Firewall uses the RetireGrant operation to remove a grant when you delete a resource.

The following example event records the CreateGrant operation:

Learn more

The following resources provide more information about data encryption at rest.