만든 키마다 나중에 사용할 수 있도록 이 명령어 출력에 KeyMetadata.Arn라는 값을 저장합니다.
특정 권한으로 KMS 키 만들기
함수마다 별도의 키를 만드는 경우 해당 키에 적합한 권한을 부여하는 KMS 키 정책을 각 키에 제공해야 합니다. 키를 만들 때 키 정책을 지정하지 않으면 AWS KMS가 소유 계정의 모든 주 구성원에 키의 모든 작업에 대한 무제한 액세스를 제공하는 기본 키 정책을 만듭니다.
키 정책을 만들 때는 AWS IAM 정책에 키 정책에 대한 액세스를 허용해야 합니다. 키 정책은 또한 IAM 정책을 사용할 수 있는 권한을 계정에 제공해야 합니다. 키 정책의 권한이 없으면 권한을 허용하는 IAM 정책이 효과가 없습니다. 자세한 내용은 AWS KMS의 키 정책을 참조하세요.
다음 표에서는 AWS용 GKE가 사용하는 각 AWS IAM 역할에 대한 권한을 설명합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-29(UTC)"],[],[],null,["# Create an AWS KMS key\n\nOverview\n--------\n\nGKE on AWS uses customer-managed\n[AWS Key Management Service](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)\n(KMS) symmetric keys to encrypt:\n\n- Kubernetes state data in [etcd](https://kubernetes.io/docs/concepts/overview/components/#etcd)\n- EC2 instance [user data](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html)\n- EBS volumes for [at-rest encryption](/kubernetes-engine/multi-cloud/docs/aws/concepts/security#at-rest_data_encryption) of control plane and node pool data\n\nFor production environments, we recommend using different keys for configuration\nand volume encryption. To further minimize risks if a key is compromised, you\ncan also create different keys for each of the following:\n\n- Cluster control plane [configuration](/sdk/gcloud/reference/container/aws/clusters/create#--config-encryption-kms-key-arn)\n- Cluster control plane [database](/sdk/gcloud/reference/container/aws/clusters/create#--database-encryption-kms-key-arn)\n- Cluster control plane [main volume](/sdk/gcloud/reference/container/aws/clusters/create#--main-volume-kms-key-arn)\n- Cluster control plane [root volume](/sdk/gcloud/reference/container/aws/clusters/create#--root-volume-kms-key-arn)\n- Node pool [configuration](/sdk/gcloud/reference/container/aws/node-pools/create#--config-encryption-kms-key-arn)\n- Node pool [root volume](/sdk/gcloud/reference/container/aws/node-pools/create#--root-volume-kms-key-arn)\n\nFor additional security, you can create an AWS KMS key policy that assigns only\nthe minimum required set of permissions. For more information, see\n[Creating KMS keys with specific permissions](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-aws-kms-key#specific-permissions).\n\nCreate an AWS KMS key\n---------------------\n\nTo create a key, run the following command: \n\n aws --region \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eAWS_REGION\u003c/span\u003e\u003c/var\u003e kms create-key \\\n --description \"\u003cvar translate=\"no\"\u003eKEY_DESC\u003c/var\u003e\"\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eAWS_REGION\u003c/var\u003e with the name of your AWS region\n- \u003cvar translate=\"no\"\u003eKEY_DESC\u003c/var\u003e with a text description of your key\n\nFor each key you create, save the value named `KeyMetadata.Arn` in the output of\nthis command for later use.\n\nCreating KMS keys with specific permissions\n-------------------------------------------\n\nIf you create separate keys for different functions, you need to provide a\n[KMS key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html)\nfor each key that grants appropriate permissions on that key. If you don't\nspecify a key policy when you create a key, AWS KMS will create a default key\npolicy that gives all\n[principals](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal)\nin the owning account unlimited access to all operations for the key.\n\nWhen you create a key policy, you must allow an AWS IAM policy access to the key\npolicy. The key policy must also give your account permissions to use IAM\npolicies. Without permission from the key policy, IAM policies that allow\npermissions have no effect. For more information, see\n[Key policies in AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html).\n\nThe following table describes the permissions for each of the\n[AWS IAM roles](/kubernetes-engine/multi-cloud/docs/aws/concepts/aws-iam-roles) GKE on AWS\nuses.\n\nWhat's next\n-----------\n\n- [Create an SSH key pair](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-ssh-keypair)."]]
