1 個回答
- 最新
- 最多得票
- 最多評論
0
Hi,
have a read at this: https://repost.aws/knowledge-center/share-kms-account.
The basic idea would be to get to order KMS keys from a central account managed by - let’s say - operations team and not accessible to developers.
This account will store keys and will contain KMS policies that would allow the team to use the key in their account, which can be changed by developers only by approval of ops team.
KMS keys will be shared across accounts so you can get their ARN and use it.
Hope it helps ;)
相關內容
- 已提問 8 個月前
- 已提問 1 年前
- AWS 官方已更新 3 年前
- AWS 官方已更新 1 年前
- AWS 官方已更新 1 年前
- AWS 官方已更新 10 個月前