X-Ray Data Encrypted With KMS Customer Master Keys

Sign in to the AWS Management Console.

Navigate to Amazon CloudWatch console at https://console.aws.amazon.com/cloudwatch/home.

In the left navigation panel, choose Settings.

In the X-Ray traces section, choose View settings under Encryption.

On the Encryption configuration section, check the existing configuration set for X-Ray traces. If the encryption type is set to Default encryption instead of Use a KMS key, the Amazon X-Ray service encrypts trace data using an AWS managed key, created by default by Amazon Web Services within the selected region.

Change the AWS region from the navigation bar and repeat the audit process for other regions.

Run get-encryption-config command (OSX/Linux/UNIX) using custom query filters to describe the ID of the KMS Customer Master Key (CMK) used for encryption (if applicable):

aws xray get-encryption-config
--region us-east-1
--query 'EncryptionConfig.KeyId'

The command output should return the requested KMS key ID or null if there is no CMK used to encrypt X-Ray trace data in the selected AWS region:

null

If get-encryption-config command output returns null, as shown in the example above, Amazon X-Ray is not using a KMS Customer Master Key (CMK) to encrypt trace data within the selected region, instead the service is using the default managed key for encryption.

Change the AWS region by updating the --region command parameter value and repeat step no. 1 and 2 to perform the audit process for other regions.

Sign in to the AWS Management Console.

Navigate to the AWS Key Management Service (AWS KMS) console at https://console.aws.amazon.com/kms/home#/kms/keys.

To change the AWS region, use the region selector in the upper-right corner of the page (must match the region where your X-Ray service is being configured).

In the left navigation panel, choose Customer managed keys.

Choose Create key.

For Key type, choose Symmetric. In Key usage, the Encrypt and decrypt option is selected by default. Choose Next.

In the Alias field, enter a unique name (alias) for the new KMS key (e.g., xray-trace-data-cmk). Optionally, enter a description for the key. Choose Next.

Under Key Administrators section, select the IAM users and/or roles that can administer the new KMS key. Choose Next.

Under Key Users section, select the IAM users and/or roles that can use the new KMS key to encrypt/decrypt the trace data with the AWS KMS API.

(Optional) Under Other AWS accounts section, choose Add another AWS account and enter an external account ID in order to add another AWS account that can use this KMS key to encrypt/decrypt the X-Ray trace data. The owners of the external AWS accounts must also provide access to this KMS key by creating appropriate policies for their IAM users.

Choose Next.

Review the key policy and key settings, then choose Finish to create your new KMS key.

Once your KMS key is created, navigate to Amazon CloudWatch console at https://console.aws.amazon.com/cloudwatch/home.

In the left navigation panel, choose Settings.

In the X-Ray traces section, choose View settings under Encryption.

In the Encryption configuration section, choose Edit, then perform the following actions:

1. Choose Use a KMS key and select the alias (name) of the KMS key created earlier from the dropdown list.

2. Choose Update encryption to apply the encryption configuration changes.

Change the AWS region from the navigation bar and repeat the entire process for other regions.

Before you create your AWS KMS Customer Master Key (CMK), you must define a policy that enables the selected IAM users and/or roles to administer the new CMK and to encrypt/decrypt X-Ray trace data using the KMS API. Create a new policy document, name it xray-kms-cmk-policy.json and paste the following content (replace the highlighted details, i.e. the ARNs for the IAM users and/or roles, with your own details):

{
    "Version": "2012-10-17",
    "Id": "aws-xray-cmk-policy",
    "Statement": [
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow access for Key Administrators",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:role/cc-xray-manager"
            },
            "Action": [
                "kms:Create*",
                "kms:Describe*",
                "kms:Enable*",
                "kms:List*",
                "kms:Put*",
                "kms:Update*",
                "kms:Revoke*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Delete*",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:ScheduleKeyDeletion",
                "kms:CancelKeyDeletion"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow use of the key",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:user/cc-xray-admin"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow attachment of persistent resources",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:user/cc-xray-admin"
            },
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        }
    ]
}

Run create-key command (OSX/Linux/UNIX) using the file name of the policy document created at the previous step (i.e. xray-kms-cmk-policy.json) as required command parameter to create the new KMS key:

aws kms create-key
--region us-east-1
--description 'AWS KMS CMK to encrypt X-Ray trace data'
--policy file://xray-kms-cmk-policy.json

The command output should return the new KMS key metadata. Copy the KMS key ARN as this identifier will be required later when you need to specify the key required for trace data encryption:

{
    "KeyMetadata": {
        "Origin": "AWS_KMS",
        "KeyId": "aaaabbbb-cccc-dddd-eeee-aaaabbbbcccc",
        "Description": "AWS KMS CMK to encrypt X-Ray trace data",
        "KeyManager": "CUSTOMER",
        "Enabled": true,
        "KeySpec": "SYMMETRIC_DEFAULT",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "Enabled",
        "CreationDate": 1517235833.150,
        "Arn": "arn:aws:kms:us-east-1:123456789012:key/aaaabbbb-cccc-dddd-eeee-aaaabbbbcccc",
        "AWSAccountId": "123456789012",
        "MultiRegion": false
    }
}

Run create-alias command (OSX/Linux/UNIX) using the key ARN returned at the previous step as the value for the "--target-key-id" parameter, to attach an alias to the new KMS key. The alias must start with the prefix "alias/" (the command does not produce an output):

aws kms create-alias
--region us-east-1
--alias-name alias/xray-trace-data-cmk
--target-key-id arn:aws:kms:us-east-1:123456789012:key/aaaabbbb-cccc-dddd-eeee-aaaabbbbcccc

Run put-encryption-config command (OSX/Linux/UNIX) using the ARN of the Customer Master Key (CMK) created earlier as command parameter, to update the encryption configuration for Amazon X-Ray service within the selected AWS region:

aws xray put-encryption-config
--region us-east-1
--type KMS
--key-id arn:aws:kms:us-east-1:123456789012:key/aaaabbbb-cccc-dddd-eeee-aaaabbbbcccc

The command output should return the encryption configuration metadata for AWS X-Ray:

{
    "EncryptionConfig": {
        "Status": "UPDATING",
        "KeyId": "arn:aws:kms:us-east-1:123456789012:key/aaaabbbb-cccc-dddd-eeee-aaaabbbbcccc",
        "Type": "KMS"
    }
}

Change the AWS region by updating the --region command parameter value and repeat the entire remediation process for other regions.