本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

Amazon 基岩工作室的加密

依預設加密靜態資料，有助於降低保護敏感資料所涉及的營運開銷和複雜性。同時，其可讓您建置符合嚴格加密合規性和法規要求的安全應用程式。

Amazon 基岩工作室使用預設 AWS擁有的金鑰來自動加密靜態資料。您無法檢視、管理或稽核 AWS 擁有金鑰的使用。如需詳細資訊，請參閱AWS 擁有的金鑰。

雖然您無法停用此層加密或選取替代加密類型，但您可以在建立 Amazon Bedrock Studio 網域時選擇客戶管理的金鑰，在現有 AWS 擁有的加密金鑰上新增第二層加密。Amazon Bedrock Studio 支援使用對稱的客戶受管金鑰，您可以建立、擁有和管理這些金鑰，透過現有 AWS 擁有的加密新增第二層加密。由於您可以完全控制此加密層，因此您可以在其中執行以下任務：

如需詳細資訊，請參閱客戶管理的金鑰。

建立客戶受管金鑰

您可以使用管理主控台來建立對稱的客戶受 AWS 管金鑰，或. AWS KMS APIs

若要建立對稱的客戶管理金鑰，請遵循金鑰管理服務開發人員指南中關於建立對稱客戶管理 AWS 金鑰的步驟。

金鑰原則-關鍵原則可控制對客戶管理金鑰的存取。每個客戶受管金鑰都必須只有一個金鑰政策，其中包含決定誰可以使用金鑰及其使用方式的陳述式。在建立客戶受管金鑰時，可以指定金鑰政策。如需詳細資訊，請參閱金鑰管理服務開發人員指南中的 AWS 管理客戶受管理金鑰的存取權限。

若要將客戶受管金鑰與 Amazon 基岩工作室資源搭配使用，必須在金鑰政策中允許下列API操作：

以下是您可以為 Amazon 基岩工作室新增的政策聲明範例。若要使用原則，請執行下列動作：

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "Enable IAM User Permissions Based on Tags",
    "Effect": "Allow",
    "Principal": {
      "AWS": "*"
    },
    "Action": [
      "kms:Decrypt",
      "kms:GenerateDataKey",
      "kms:GenerateDataKeyPair",
      "kms:GenerateDataKeyPairWithoutPlaintext",
      "kms:GenerateDataKeyWithoutPlaintext",
      "kms:Encrypt"
    ],
    "Resource": "\{FIXME:KMS_ARN\}",
    "Condition": {
      "StringEquals": {
        "aws:PrincipalTag/AmazonBedrockManaged": "true",
        "kms:CallerAccount" : "\{FIXME:ACCOUNT_ID\}"
      },
      "StringLike": {
        "aws:PrincipalTag/AmazonDataZoneEnvironment": "*"
      }
    }
  },
    {
      "Sid": "Allow Amazon Bedrock to encrypt and decrypt Agent resources on behalf of authorized users",
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt"
      ],
      "Resource": "\{FIXME:KMS_ARN\}",
      "Condition": {
        "StringLike": {
          "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:\{FIXME:REGION\}:\{FIXME:ACCOUNT_ID\}:agent/*"
        }
      }
    },
    {
      "Sid": "Allows AOSS list keys",
      "Effect": "Allow",
      "Principal": {
        "Service": "aoss.amazonaws.com"
      },
      "Action": "kms:ListKeys",
      "Resource": "*"
    },
    {
      "Sid": "Allows AOSS to create grants",
      "Effect": "Allow",
      "Principal": {
        "Service": "aoss.amazonaws.com"
      },
      "Action": [
        "kms:DescribeKey",
        "kms:CreateGrant"
      ],
      "Resource": "\{FIXME:KMS_ARN\}",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "aoss.\{FIXME:REGION\}.amazonaws.com"
        },
        "Bool": {
          "kms:GrantIsForAWSResource": "true"
        }
      }
    },
    {
      "Sid": "Enable Decrypt, GenerateDataKey for DZ execution role",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::\{FIXME:ACCOUNT_ID\}:root"
      },
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "\{FIXME:KMS_ARN\}",
      "Condition": {
        "StringLike": {
          "kms:EncryptionContext:aws:datazone:domainId": "*"
        }
      }
    },
    {
      "Sid": "Allow attachment of persistent resources",
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": [
        "kms:CreateGrant",
        "kms:ListGrants",
        "kms:RetireGrant"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "kms:CallerAccount": "\{FIXME:ACCOUNT_ID\}"
        },
        "Bool": {
          "kms:GrantIsForAWSResource": "true"
        }
      }
    },
    {
      "Sid": "AllowPermissionForEncryptedGuardrailsOnProvisioningRole",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::\{FIXME:ACCOUNT_ID\}:role/\{provisioning role name\}"
      },
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt",
        "kms:DescribeKey",
        "kms:CreateGrant",
        "kms:Encrypt"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Allow use of CMK to encrypt logs in their account",
      "Effect": "Allow",
      "Principal": {
        "Service": "logs.\{FIXME:REGION\}.amazonaws.com"
      },
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncryptFrom",
        "kms:ReEncryptTo",
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyPair",
        "kms:GenerateDataKeyPairWithoutPlaintext",
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:DescribeKey"
      ],
      "Resource": "*",
      "Condition": {
        "ArnLike": {
          "kms:EncryptionContext:aws:logs:arn": "arn:aws:logs:\{FIXME:REGION\}:\{FIXME:ACCOUNT_ID\}:log-group:*"
        }
      }
    },
    {
      "Sid": "Allow access for Key Administrators",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::\{FIXME:ACCOUNT_ID\}:role/\{Admin Role Name\}"
      },
      "Action": [
        "kms:Create*",
        "kms:Describe*",
        "kms:Enable*",
        "kms:List*",
        "kms:Put*",
        "kms:Update*",
        "kms:Revoke*",
        "kms:Disable*",
        "kms:Get*",
        "kms:Delete*",
        "kms:TagResource",
        "kms:UntagResource",
        "kms:ScheduleKeyDeletion",
        "kms:CancelKeyDeletion"
      ],
      "Resource": "*"
    }
  ]
}

如需有關在原則中指定權限的詳細資訊，請參閱 AWS 金鑰管理服務開發人員指南。

如需疑難排解金鑰存取的詳細資訊，請參閱 AWS 金鑰管理服務開發人員指南。