Cloud Firewall:Encrypt logs

Limits

When you configure data encryption settings for the first time, you can select a data encryption mechanism. After the settings are configured, you cannot change the data encryption mechanism or modify the encryption algorithm or encryption type. You can configure only the enable parameter to enable or disable data encryption. You must add the complete settings of the encrypt_conf parameter each time you update a Logstore.

For example, the first time you select encryption by using service keys provided by Simple Log Service, you cannot switch to encryption by using BYOK keys.

Encryption by using service keys

When you call the CreateLogStore operation to create a Logstore or call the UpdateLogStore operation to modify a Logstore, add the encrypt_conf parameter to configure the encryption settings. For more information, see CreateLogStore or UpdateLogStore.

The following table describes the fields in the encrypt_conf parameter. Do not specify the user_cmk_info field.

Encryption by using BYOK keys

Prerequisites

Key Management Service (KMS) is activated. For more information, see Purchase a dedicated KMS instance.

Step 1: Authorize Simple Log Service to access KMS

Before you can use a BYOK key to encrypt data, you must authorize Simple Log Service to access KMS.

1. Log on to the RAM console.

2. Create a RAM role. For more information, see Step 1: Create a RAM role.

3. Modify the trust policy of the RAM role. For more information, see Edit the trust policy of a RAM role.

   {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "Service": [
                       "log.aliyuncs.com"
                   ]
               }
           }
       ],
       "Version": "1"
   }

4. Grant the AliyunKMSReadOnlyAccess and AliyunKMSCryptoUserAccess permissions to the RAM role. For more information, see Grant permissions to a RAM role.

   

5. Before you can use a RAM user to encrypt data by using a BYOK key, you must grant the PassRole permission to the RAM user. To grant the PassRole permission to the RAM user, you can create a custom policy and attach the policy to the RAM user. For more information, see Create a custom policy and Grant permissions to RAM users.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "ram:PassRole",
               "Resource": "acs:ram::*"   # The Alibaba Cloud Resource Name (ARN) of the RAM role. For more information, see How do I obtain the ARN of a RAM role? 
           }
       ]
   }

Step 2: Configure data encryption for a Logstore

After you enable the log analysis feature, the system automatically creates a dedicated project and a dedicated Logstore. You must call the UpdateLogStore operation to encrypt data and add the encrypt_conf parameter to configure the encryption settings.

Before you call the UpdateLogStore operation, you must call the GetLogStore operation to obtain the original configurations of the Logstore. After you modify the configurations, add the configuration after modification to the UpdateLogStore operation.

The following table describes the fields in the encrypt_conf parameter. You must configure the user_cmk_info parameter.

Data structure of EncryptUserCmkConf

encrypt_conf = {
    "enable" : True, # Specifies whether data encryption is enabled. 
    "encrypt_type" : "default"# The encryption algorithm. Valid values: default and m4. 
    "user_cmk_info" : # Optional parameter. If you configure this parameter, the BYOK key is used. If you do not configure this parameter, the service key is used. 
    {
          "cmk_key_id" : "" # The ID of the CMK to which the BYOK key belongs, for example, f5136b95-2420-ab31-xxxxxxxxx. 
          "arn" :  "" # The ARN of the RAM role. For more information, see How do I obtain the ARN of a RAM role? 
          "region_id" : "" # The ID of the region where the CMK resides. 
    }
}

References

For more information, refer to the following operations of Simple Log Service:

• CreateLogStore

• UpdateLogStore

• GetLogStore