User Guide

AWS Secrets Manager KMS

The platform supports AWS Secrets Manager as a key management system (KMS).

Create a KMS Key to Be Used by the AWS Secrets Manager

Note

This is optional but recommended for production environments.

To learn more: AWS Documentation: Creating symmetric CMKs

  1. Open AWS Key Management Service (KMS) and create a symmetric key.

  2. Define the administrative permissions. Select an admin user who can manage and rotate the key, if needed.

  3. Define the key usage permissions. This needs to be a role with permissions to the data processor. You can provide permissions to the same role to which you provided access to AWS Secrets Manager.

  4. Create the key and make note of the key ID. You will use this key ID when you configure the KMS environment in Policy Manager.

AWS Secrets Manager KMS Configuration

To configure AWS Secrets Manager as the KMS in the Policy Manager:

  1. In the Environments settings, click the Key Management tab.

  2. Key Management System—Select "AWS Secrets Manager."

  3. AWS Region—Set this to the AWS region that you will use to access the AWS Secrets Manager. For example, us-west-2. To ensure consistent hashing, it is important to use AWS Secrets Manager from the same region. If the region is not defined, the Privitar processing engine will use the default region (for example, POD, Hadoop nodes, or SDK), which might be subject to change.

  4. AWS Endpoint—Set this to the URL of the AWS endpoint that is used to make a private connection between your VPC and AWS Secrets Manager. When you use a VPC service endpoint, communication between your VPC and Secrets Manager occurs entirely within the AWS network and requires no public Internet access. For security, we recommend that you create this endpoint. For more information, see AWS Secrets Manager - User Guide.

  5. AWS KMS Key—We recommend defining a master key that AWS Secrets Manager will use to protect every secret that it stores. For more information, see AWS KMS Developer Guide.

  6. AWS Secrets tags—Enter the tags that will be attached to any secrets created by the Privitar Platform.

  7. NOVLT Key Name—Enter the key name.

For AWS Secrets Manager in Glue Environments, you cannot configure the KMS through the user interface or an API. The configuration will be as follows:

  • AWS Region—Always the same as the region of the Glue environment

  • AWS Endpoint—The default endpoint (not configurable for Glue environments)

  • AWS KMS Key—The AWS account's default customer master key (CMK), the one named aws/secretsmanager, for the region

  • AWS Secrets tags—Tags are the ones provided to cloud formation as the TAGS parameter

In this section: