승인된 각 액세스 승인 요청은 승인을 검증하기 위해 비대칭 암호화 키로 서명됩니다. 승인된 요청은 Google 관리 키 또는 고객 제공 Cloud KMS 키로 서명될 수 있습니다.
서명을 검증하면 직렬화된 승인된 요청의 바이트 문자열이 유효한지 확인할 수 있습니다. 승인 콘텐츠의 검증을 완료하려면 메시지를 역직렬화하고 역직렬화된 메시지를 승인된 요청의 콘텐츠와 비교해야 합니다.
시작하기 전에
리소스의 액세스 승인 서비스 계정에 승인된 요청 서명을 확인하는 데 필요한 권한이 있는지 확인하려면 키, 키링 또는 키 프로젝트에 대한 Cloud KMS CryptoKey 서명자/확인자(roles/cloudkms.signerVerifier) IAM 역할을 리소스의 액세스 승인 서비스 계정에 부여해 달라고 관리자에게 요청하세요.
역할 부여에 대한 자세한 내용은 프로젝트, 폴더, 조직에 대한 액세스 관리를 참조하세요.
관리자는 커스텀 역할이나 다른 사전 정의된 역할을 통해 리소스의 액세스 승인 서비스 계정에 필요한 권한을 부여할 수도 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[[["\u003cp\u003eAccess Approval requests are signed with either a Google-managed key or a customer-provided Cloud KMS key to validate the approval.\u003c/p\u003e\n"],["\u003cp\u003eValidating a signature confirms the integrity of the bytestring of the serialized approved request, which must also be deserialized and compared with the approved request's contents.\u003c/p\u003e\n"],["\u003cp\u003eThe Access Approval service account must be granted the \u003ccode\u003eroles/cloudkms.signerVerifier\u003c/code\u003e IAM role on the key, key ring, or key project to ensure it has the necessary permissions to verify request signatures.\u003c/p\u003e\n"],["\u003cp\u003eValidation involves copying the public key, signature, and serialized approval request from the Google Cloud console to Cloud Shell, decoding them, and using \u003ccode\u003eopenssl\u003c/code\u003e to verify the signature.\u003c/p\u003e\n"],["\u003cp\u003eThe result \u003ccode\u003eVerified OK\u003c/code\u003e from \u003ccode\u003eopenssl\u003c/code\u003e confirms that the serialized request is valid, regardless of if it was signed with a Google or customer-managed key.\u003c/p\u003e\n"]]],[],null,["# Validate an approved request signature\n======================================\n\nEach approved Access Approval request is signed with an asymmetric\ncryptographic key to validate the approval. Approved requests can be signed with\na Google-owned and managed key or a customer-provided\nCloud KMS key.\n\nWhen you validate a signature, you can be sure that the bytestring of the\nserialized approved request is valid. To finish validating the contents of the\napproval, you must deserialize the message and compare the deserialized\nmessage with the contents of the approved request.\n\nBefore you begin\n----------------\n\n\nTo ensure that the Access Approval service account for your\nresource has the necessary\npermissions to verify approved request signatures,\n\nask your administrator to grant the Access Approval service account for your\nresource the\n\n\n[Cloud KMS CryptoKey Signer/Verifier](/iam/docs/roles-permissions/cloudkms#cloudkms.signerVerifier) (`roles/cloudkms.signerVerifier`)\nIAM role on the key, key ring, or key project.\n\n\n| **Important:** You must grant this role to the Access Approval service account for your resource, *not* to your user account. Failure to grant the role to the correct principal might result in permission errors.\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\u003cbr /\u003e\n\n\nYour administrator might also be able to give the Access Approval service account for your\nresource\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nValidate a request signed using a Google-owned and managed key\n--------------------------------------------------------------\n\n1. In the Google Cloud console, go to the **Access Approval** page.\n\n [Go to Access\n Approval](https://console.cloud.google.com/security/access-approval)\n2. Locate and select the approved Access Approval request that you\n want to validate. The **Request details** page opens.\n\n3. Under **Google-managed public key** , click\n content_copy **Copy**.\n\n4. Open the Cloud Shell, and then save the public key as a new file named\n `public_key`:\n\n echo \u003cvar translate=\"no\"\u003eGOOGLE_MANAGED_PUBLIC_KEY\u003c/var\u003e \u003e ./public_key\n\n Replace \u003cvar translate=\"no\"\u003eGOOGLE_MANAGED_PUBLIC_KEY\u003c/var\u003e with the contents of\n the **Google-managed public key** field.\n5. In the Google Cloud console, on the **Request details** page, under\n **Signature** , click\n content_copy **Copy**.\n\n6. Open the Cloud Shell, and then save the signature as a new file named\n `signature.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e \u003e ./signature.txt\n\n Replace \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e with the contents of the **Signature**\n field.\n7. Decode the signature using the `base64` command and save the result as\n `decoded_signature`:\n\n base64 ./signature.txt -d \u003e ./decoded_signature\n\n8. In the Google Cloud console, on the **Request details** page, under\n **Serialized Approval Request** , click\n content_copy **Copy**.\n\n9. Open the Cloud Shell, and then save the serialized approval request as a\n new file named `serialized_approval_request.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e \u003e ./serialized_approval_request.txt\n\n Replace \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e with the contents of\n the **Serialized Approval Request** field.\n10. Decode the serialized approval request and save the result as\n `decoded_serialized_approval_request`:\n\n base64 ./serialized_approval_request.txt -d \u003e ./decoded_serialized_approval_request\n\n11. Use `openssl` to verify the signature:\n\n openssl dgst \\\n -sha256 \\\n -verify ./public_key \\\n -signature ./decoded_signature \\\n ./decoded_serialized_approval_request\n\n If the signature is valid, the output should be `Verified OK`. This\n confirms that the serialized approval request is valid.\n\nValidate a request signed using a customer-provided key\n-------------------------------------------------------\n\n1. In the Google Cloud console, go to the **Access Approval** page.\n\n [Go to Access\n Approval](https://console.cloud.google.com/security/access-approval)\n2. Locate and select the approved Access Approval request that you\n want to validate. The **Request details** page opens.\n\n3. In the Google Cloud console, on the **Request details** page, under\n **Signature** , click\n content_copy **Copy**.\n\n4. Open the Cloud Shell, and then save the signature as a new file named\n `signature.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e \u003e ./signature.txt\n\n Replace \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e with the contents of the **Signature**\n field.\n5. Decode the signature and save the result as `decoded_signature`:\n\n base64 ./signature.txt -d \u003e ./decoded_signature\n\n6. In the Google Cloud console, on the **Request details** page, under\n **Serialized Approval Request** , click\n content_copy **Copy**.\n\n7. Open the Cloud Shell, and then save the serialized approval request as a\n new file named `serialized_approval_request.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e \u003e ./serialized_approval_request.txt\n\n Replace \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e with the contents of\n the **Serialized Approval Request** field.\n8. Decode the serialized approval request and save the result as\n `decoded_serialized_approval_request`:\n\n base64 ./serialized_approval_request.txt -d \u003e ./decoded_serialized_approval_request\n\n9. Under **Customer-managed key**, make note of the resource identifier of\n the key.\n\n10. [Retrieve the public key](/kms/docs/retrieve-public-key) for the key that\n you identified in the previous step. Save the downloaded public key in the\n PEM format as `./public_key`.\n\n11. Use `openssl` to verify the signature:\n\n openssl dgst \\\n -sha256 \\\n -verify ./public_key \\\n -signature ./decoded_signature \\\n ./decoded_serialized_approval_request\n\n If the signature is valid, the output should be `Verified OK`. This\n confirms that the serialized approval request is valid."]]
