Untuk lingkungan produksi, sebaiknya gunakan kunci yang berbeda untuk enkripsi konfigurasi dan volume. Untuk lebih meminimalkan risiko jika kunci disusupi, Anda
juga dapat membuat kunci yang berbeda untuk setiap hal berikut:
Untuk keamanan tambahan, Anda dapat membuat kebijakan kunci AWS KMS yang hanya menetapkan serangkaian izin minimum yang diperlukan. Untuk mengetahui informasi selengkapnya, lihat
Membuat kunci KMS dengan izin tertentu.
Untuk setiap kunci yang Anda buat, simpan nilai bernama KeyMetadata.Arn dalam output
perintah ini untuk digunakan nanti.
Membuat kunci KMS dengan izin tertentu
Jika Anda membuat kunci terpisah untuk fungsi yang berbeda, Anda harus memberikan
kebijakan kunci KMS
untuk setiap kunci yang memberikan izin yang sesuai pada kunci tersebut. Jika Anda tidak
menentukan kebijakan kunci saat membuat kunci, AWS KMS akan membuat kebijakan kunci default yang memberi semua
principal
di akun pemilik akses tanpa batas ke semua operasi untuk kunci tersebut.
Saat membuat kebijakan kunci, Anda harus mengizinkan akses kebijakan IAM AWS ke kebijakan kunci. Kebijakan kunci juga harus memberikan izin akun Anda untuk menggunakan kebijakan IAM. Tanpa izin dari kebijakan kunci, kebijakan IAM yang mengizinkan izin tidak akan berpengaruh. Untuk mengetahui informasi selengkapnya, lihat Kebijakan kunci di AWS KMS.
Tabel berikut menjelaskan izin untuk setiap peran IAM AWS yang digunakan GKE di AWS.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-22 UTC."],[],[],null,["# Create an AWS KMS key\n\nOverview\n--------\n\nGKE on AWS uses customer-managed\n[AWS Key Management Service](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)\n(KMS) symmetric keys to encrypt:\n\n- Kubernetes state data in [etcd](https://kubernetes.io/docs/concepts/overview/components/#etcd)\n- EC2 instance [user data](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html)\n- EBS volumes for [at-rest encryption](/kubernetes-engine/multi-cloud/docs/aws/concepts/security#at-rest_data_encryption) of control plane and node pool data\n\nFor production environments, we recommend using different keys for configuration\nand volume encryption. To further minimize risks if a key is compromised, you\ncan also create different keys for each of the following:\n\n- Cluster control plane [configuration](/sdk/gcloud/reference/container/aws/clusters/create#--config-encryption-kms-key-arn)\n- Cluster control plane [database](/sdk/gcloud/reference/container/aws/clusters/create#--database-encryption-kms-key-arn)\n- Cluster control plane [main volume](/sdk/gcloud/reference/container/aws/clusters/create#--main-volume-kms-key-arn)\n- Cluster control plane [root volume](/sdk/gcloud/reference/container/aws/clusters/create#--root-volume-kms-key-arn)\n- Node pool [configuration](/sdk/gcloud/reference/container/aws/node-pools/create#--config-encryption-kms-key-arn)\n- Node pool [root volume](/sdk/gcloud/reference/container/aws/node-pools/create#--root-volume-kms-key-arn)\n\nFor additional security, you can create an AWS KMS key policy that assigns only\nthe minimum required set of permissions. For more information, see\n[Creating KMS keys with specific permissions](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-aws-kms-key#specific-permissions).\n\nCreate an AWS KMS key\n---------------------\n\nTo create a key, run the following command: \n\n aws --region \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eAWS_REGION\u003c/span\u003e\u003c/var\u003e kms create-key \\\n --description \"\u003cvar translate=\"no\"\u003eKEY_DESC\u003c/var\u003e\"\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eAWS_REGION\u003c/var\u003e with the name of your AWS region\n- \u003cvar translate=\"no\"\u003eKEY_DESC\u003c/var\u003e with a text description of your key\n\nFor each key you create, save the value named `KeyMetadata.Arn` in the output of\nthis command for later use.\n\nCreating KMS keys with specific permissions\n-------------------------------------------\n\nIf you create separate keys for different functions, you need to provide a\n[KMS key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html)\nfor each key that grants appropriate permissions on that key. If you don't\nspecify a key policy when you create a key, AWS KMS will create a default key\npolicy that gives all\n[principals](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal)\nin the owning account unlimited access to all operations for the key.\n\nWhen you create a key policy, you must allow an AWS IAM policy access to the key\npolicy. The key policy must also give your account permissions to use IAM\npolicies. Without permission from the key policy, IAM policies that allow\npermissions have no effect. For more information, see\n[Key policies in AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html).\n\nThe following table describes the permissions for each of the\n[AWS IAM roles](/kubernetes-engine/multi-cloud/docs/aws/concepts/aws-iam-roles) GKE on AWS\nuses.\n\nWhat's next\n-----------\n\n- [Create an SSH key pair](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-ssh-keypair)."]]
