3 ms·
Bookmarking this. Additionally I assume you could also limit access to KMS so that only your servers can issue requests.
by t0astbread 6y ago
Bookmarking this. Additionally I assume you could also limit access to KMS so that only your servers can issue requests.
- hn_throwaway_99 6y agoYep. Not sure the details of AWS, but in GCP access to KMS APIs and specific keys is controlled by IAM, and you can set "conditions" on IAM policies to restrict access by things like IP of the request: https://cloud.google.com/iam/docs/conditions-overview https://cloud.google.com/iam/docs/conditions-overview
- WrtCdEvrydy 6y agoKMS is managed by IAM so you can attach roles or use STS (create an access key / password) that can assume a role that can encrypt.