Set up Module Access Policies

Define which user roles can view encrypted data in clear text by configuring module access policies for External Key Management Service (EKMS).

始める前に

Role required: admin

Confirm that you have:

• Created a cryptographic module with external key wrapping enabled
• Created an Encrypted Field Configuration

手順

1. Navigate to All > System Security > Field Encryption > Field Encryption Enterprise > Configurations > Access Policies.
   注:

   For additional information, refer to Configure module access policies for Field Encryption.
2. Select Configure.
3. Complete the Module Access Policy (MAP) form.

   表 : 1. MAP Form

   Field	Description
   Policy name	Enter a name for the policy.
   Type
   Target scope	Field is visible as an identifier for the Scope type. Refers to the functionality for the policy. Select the applications from the search menu.
   Specify purpose	Optional.  Enable  to  display  the  Crypto  Spec  field  on  the  form.  Enable this option to configure granular operations, such as some users being able to encrypt, but not decrypt.
   Application	The  Application scope  is  auto-populated  by  your  current scope.
   Active	Select to activate the policy.
   Result	Select one of the following: StrictReject rejects access under all circumstances. Reject rejects users with the Target Role or Target Scope from accessing this cryptographic module unless another policy grants them access. Track to permit access and monitor use of the module.

タスクの結果

The Module Access Policy for the script is available in the system.

Next steps:

• Test an external key definition
• Learn how to change the status of an AWS KMS Key