content-analysis-on-aws icon indicating copy to clipboard operation
content-analysis-on-aws copied to clipboard

Published 20 hours ago • verified publisher icon aws-solutions

Investigate required steps to get CAS working with MIE CMK

Open brandold opened this issue 2 years ago • 1 comments

MIE has added a stack level CMK that encrypts all services. CAS needs to be able to work with this key.

brandold avatar Mar 07 '22 22:03 brandold

  1. Need to add "kms:Decrypt" permissions to consumer lambda
  2. Need to add "kms:Encrypt" and "kms:GenerateDataKey" to federated IAM roles
  3. Need to adjust MIE DDB stream lambda IAM role to have "kms:Decrypt" permission in addition to generate data key
  4. Need to add parameter in both CF stacks for retrieving the MIE KMS Key ARN

brandold avatar Mar 21 '22 20:03 brandold