创建 KMS 密钥策略在 Go 中探索

怎么入门Golang编程？需要学习哪些知识点？这是新手们刚接触编程时常见的问题；下面golang学习网就来给大家整理分享一些知识点，希望能够给初学者一些帮助。本篇文章就来介绍《创建 KMS 密钥策略在 Go 中探索》，涉及到，有需要的可以收藏一下

我正在尝试使用 aws sdk v2 函数调用创建 kms 密钥：

conn := kms.NewFromConfig(cfg)

input := kms.CreateKeyInput{
    KeySpec:     types.KeySpecEccNistP521,
    KeyUsage:    types.KeyUsageTypeSignVerify,
    MultiRegion: aws.Bool(true),
    Policy:      aws.String("")
}

output, err := conn.CreateKey(ctx, &input)

我遇到的问题是我不确定如何生成密钥的策略。我假设我可以为 iam 策略文档创建 json，但我认为自己生成该文档的前景并不特别诱人。是否有可以用来生成此文档的包或库？

正确答案

我最终创建了自己的策略结构：

// policy describes a policy document that can be used to configure permissions in iam
type policy struct {
    version    string       `json:"version"`
    id         string       `json:"id"`
    statements []*statement `json:"statement"`
}

// statement describes a set of permissions that define what resources and users should have access
// to the resources described therein
type statement struct {
    id            string     `json:"sid"`
    effect        effect     `json:"effect"`
    principalarns principals `json:"principal"`
    actionarns    actions    `json:"action"`
    resourcearns  resources  `json:"resource"`
}

// principals describes a list of principals associated with a policy statement
type principals []string

// marhsaljson converts a principals collection to json
func (p principals) marshaljson() ([]byte, error) {

    // first, get the inner string from the list of principals
    var inner string
    if len(p) > 1 {
        inner = marshal(p...)
    } else if len(p) == 1 {
        inner = strings.quote(p[0], "\"")
    } else {
        return nil, fmt.errorf("principal must contain at least one element")
    }

    // next, create the principal block and return it
    return []byte(fmt.sprintf("{\"aws\": %s}", inner)), nil
}

// actions describes a list of actions that may or may not be taken by principals with regard to the
// resources described in a policy statement
type actions []action

// marshaljson converts an actions collection to json
func (a actions) marshaljson() ([]byte, error) {

    // first, get the inner string from the list of actions
    var inner string
    if len(a) > 1 {
        inner = marshal(a...)
    } else if len(a) == 1 {
        inner = strings.quote(a[0], "\"")
    } else {
        return nil, fmt.errorf("action must contain at least one element")
    }

    // next, create the action block and return it
    return []byte(inner), nil
}

// resources describes a list of resources effected by the policy statement
type resources []string

// marshaljson converts a resources collection to json
func (r resources) marshaljson() ([]byte, error) {

    // first, get the inner string from the list of actions
    var inner string
    if len(r) > 1 {
        inner = marshal(r...)
    } else if len(r) == 1 {
        inner = strings.quote(r[0], "\"")
    } else {
        return nil, fmt.errorf("resource must contain at least one element")
    }

    // next, create the action block and return it
    return []byte(inner), nil
}

// helper function that converts a list of items to a json-string
func marshal[s ~string](items ...s) string {
    return "[" + strings.modifyandjoin(func(item string) string { return strings.quote(item, "\"") }, ",", items...) + "]"
}

// effect describes the effect a policy statement will have upon the resource and for the actions described
type effect string

var (

    // allow to grant access of the resource and actions to the principals described in the policy statement
    allow = effect("allow")

    // deny to deny access of the resource and actions from the principals described in the policy statement
    deny = effect("deny")
)

// action describes a valid operation that may be made against a particular aws resource
type action string

// describes the various action types available to aws
var (
    cancelkeydeletion                   = action("kms:cancelkeydeletion")
    connectcustomkeystore               = action("kms:connectcustomkeystore")
    createalias                         = action("kms:createalias")
    createcustomkeystore                = action("kms:createcustomkeystore")
    creategrant                         = action("kms:creategrant")
    createkey                           = action("kms:createkey")
    decrypt                             = action("kms:decrypt")
    deletealias                         = action("kms:deletealias")
    deletecustomkeystore                = action("kms:deletecustomkeystore")
    deleteimportedkeymaterial           = action("kms:deleteimportedkeymaterial")
    describecustomkeystores             = action("kms:describecustomkeystores")
    describekey                         = action("kms:describekey")
    disablekey                          = action("kms:disablekey")
    disablekeyrotation                  = action("kms:disablekeyrotation")
    disconnectcustomkeystore            = action("kms:disconnectcustomkeystore")
    enablekey                           = action("kms:enablekey")
    enablekeyrotation                   = action("kms:enablekeyrotation")
    encrypt                             = action("kms:encrypt")
    generatedatakey                     = action("kms:generatedatakey")
    generatedatakeypair                 = action("kms:generatedatakeypair")
    generatedatakeypairwithoutplaintext = action("kms:generatedatakeypairwithoutplaintext")
    generatedatakeywithoutplaintext     = action("kms:generatedatakeywithoutplaintext")
    generatemac                         = action("kms:generatemac")
    generaterandom                      = action("kms:generaterandom")
    getkeypolicy                        = action("kms:getkeypolicy")
    getkeyrotationstatus                = action("kms:getkeyrotationstatus")
    getparametersforimport              = action("kms:getparametersforimport")
    getpublickey                        = action("kms:getpublickey")
    importkeymaterial                   = action("kms:importkeymaterial")
    listaliases                         = action("kms:listaliases")
    listgrants                          = action("kms:listgrants")
    listkeypolicies                     = action("kms:listkeypolicies")
    listkeys                            = action("kms:listkeys")
    listresourcetags                    = action("kms:listresourcetags")
    listretirablegrants                 = action("kms:listretirablegrants")
    putkeypolicy                        = action("kms:putkeypolicy")
    reencryptfrom                       = action("kms:reencryptfrom")
    reencryptto                         = action("kms:reencryptto")
    replicatekey                        = action("kms:replicatekey")
    retiregrant                         = action("kms:retiregrant")
    revokegrant                         = action("kms:revokegrant")
    schedulekeydeletion                 = action("kms:schedulekeydeletion")
    sign                                = action("kms:sign")
    tagresource                         = action("kms:tagresource")
    untagresource                       = action("kms:untagresource")
    updatealias                         = action("kms:updatealias")
    updatecustomkeystore                = action("kms:updatecustomkeystore")
    updatekeydescription                = action("kms:updatekeydescription")
    updateprimaryregion                 = action("kms:updateprimaryregion")
    verify                              = action("kms:verify")
    verifymac                           = action("kms:verifymac")
    kmsall                              = action("kms:*")
)

然后我可以在我的代码中使用它，如下所示：

conn := kms.NewFromConfig(cfg)

policy := Policy {
    Version: "2012-10-17",
    ID:      "test-key",
    Statements: []*policy.Statement{
        {
            ID:            "test-failure",
            Effect:        policy.Allow,
            PrincipalArns: []string{"arn:aws:kms:eu-west-2:111122223333:root"},
            ActionArns:    policy.Actions{policy.KmsAll},
            ResourceArns:  []string{"*"},
        },
    },
}

pData, err := json.Marshal(policy)
if err != nil {
   return err
}

input := kms.CreateKeyInput{
    KeySpec:     types.KeySpecEccNistP521,
    KeyUsage:    types.KeyUsageTypeSignVerify,
    MultiRegion: aws.Bool(true),
    Policy:      aws.String(string(pData)),
}

output, err := conn.CreateKey(ctx, &input)

我在一个开源包中添加了此代码，可以在 here 中找到，以便其他人可以使用它。

今天关于《创建 KMS 密钥策略在 Go 中探索》的内容介绍就到此结束，如果有什么疑问或者建议，可以在golang学习网公众号下多多回复交流；文中若有不正之处，也希望回复留言以告知！