GKE on AWS는 AWS 키 관리 서비스(KMS)를 사용하여 EBS 볼륨을 암호화합니다. GKE on AWS 1.7 이상은 고객 관리 고객 마스터 키(CMK)로 볼륨 암호화를 지원합니다. GKE on AWS 1.6.x 이하 버전은 AWS 관리 고객 마스터 키만 지원합니다.
이 주제에서는 볼륨을 암호화하도록 고객 관리 CMK를 설정하는 방법을 설명합니다. 고객 관리 CMK를 설정하지 않으면 GKE on AWS는 기본적으로 AWS 관리 CMK를 사용합니다.
개요
GKE on AWS 구성요소는 고객 관리 CMK의 암호화된 볼륨을 지원합니다.
배스천 호스트 루트 볼륨
관리형 서비스 루트 볼륨
관리형 서비스 etcd 데이터 볼륨
사용자 클러스터 컨트롤 플레인 루트 볼륨
사용자 클러스터 컨트롤 플레인 etcd 데이터 볼륨
사용자 클러스터 노드 루트 볼륨
관리형 서비스, 클러스터, 노드 풀 구성에서 키를 지정합니다.
기본 요건
GKE on AWS 루트 볼륨의 고객 관리 CMK를 사용하려면 다음이 필요합니다.
AWS KMS 키 정책을 만들거나 사용할 수 있는 권한입니다. 자세한 내용은 AWS KMS에서 키 정책 사용을 참조하세요.
키 정책 만들기
AWS KMS 키에는 GKE on AWS가 고객 관리 CMK로 암호화된 볼륨을 만들고 읽을 수 있는 키 정책이 있어야 합니다. 정책 예시는 다음 섹션에 나와 있습니다. 정책을 만들려면 다음 단계를 수행하세요.
anthos-aws 디렉터리에서 terraform을 사용하여 관리 서비스 ID를 가져옵니다.
cd anthos-aws
terraform output cluster_id
출력에 관리 서비스 ID가 포함됩니다. 다음 예시에서 ID는 gke-12345abc입니다.
{"Version":"2012-10-17","Id":"key-consolepolicy-3","Statement":[{"Sid":"Enable IAM User Permissions","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::ACCOUNT_NUMBER:root"},"Action":"kms:*","Resource":"*"},{"Sid":"Allow creating encrypted EBS volumes for EC2 use","Effect":"Allow","Principal":{"AWS":["arn:aws:iam::ACCOUNT_NUMBER:role/gke-CLUSTER_ID-management","arn:aws:iam::ACCOUNT_NUMBER:user/AWS_USER","arn:aws:iam::ACCOUNT_NUMBER:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"]},"Action":["kms:GenerateDataKeyWithoutPlaintext","kms:Decrypt"],"Resource":"*","Condition":{"StringEquals":{"kms:CallerAccount":"ACCOUNT_NUMBER","kms:ViaService":"ec2.AWS_REGION.amazonaws.com"}}},{"Sid":"Allow attaching encrypted EBS volumes for EC2 Use","Effect":"Allow","Principal":{"AWS":["arn:aws:iam::ACCOUNT_NUMBER:role/CLUSTER_ID-management","arn:aws:iam::ACCOUNT_NUMBER:role/CLUSTER_ID-controlplane","arn:aws:iam::ACCOUNT_NUMBER:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"]},"Action":["kms:CreateGrant","kms:ListGrants","kms:RevokeGrant"],"Resource":"*","Condition":{"StringEquals":{"kms:CallerAccount":"ACCOUNT_NUMBER","kms:ViaService":"ec2.AWS_REGION.amazonaws.com"}}}]}
다음을 바꿉니다.
ACCOUNT_NUMBER: AWS 계정 번호입니다(예: 1234567890).
CLUSTER_ID: GKE on AWS 관리 클러스터 ID입니다(예: gke-12345678).
AWS_USER: AWS 사용자 이름입니다.
AWS_REGION: GKE on AWS 클러스터가 실행되는 AWS 리전입니다(예: us-east1).
고객 관리 CMK를 사용하도록 리소스 구성
이 섹션에서는 GKE on AWS 구성요소의 고객 관리 CMK를 구성하는 방법을 설명합니다. 기존 구성요소를 업그레이드하기 전에 기존 클러스터와 함께 CMK 사용을 참조하세요.
배스천 호스트 및 관리 서비스
관리형 서비스를 설정하기 전에 anthos-gke.yaml에서 배스천 호스트 루트 볼륨, 관리형 서비스 루트 볼륨, 관리형 서비스 etcd 데이터 볼륨의 고객 관리 CMK를 구성합니다. 자세한 내용은 기존 인프라 통합 및 AWSManagementService 참조를 확인하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Using a customer managed CMK to encrypt volumes\n\nGKE on AWS uses the AWS Key Management Service (KMS) to encrypt\nEBS volumes. GKE on AWS 1.7 and higher supports encrypting volumes\nwith customer managed\n[Customer Master Keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk)\n(CMKs). GKE on AWS versions 1.6.x and lower support\n[AWS Managed Customer Master Keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk) only.\n\nThis topic describes how to set up customer managed CMK to encrypt volumes. If\nyou don't set up customer managed CMK, GKE on AWS uses AWS managed\nCMKs by default.\n\nOverview\n--------\n\nThe following GKE on AWS components support customer managed\nCMK encrypted volumes:\n\n- Bastion host root volume\n- Management service root volumes\n- Management service etcd data volumes\n- User cluster control plane root volumes\n- User cluster control plane etcd data volumes\n- User cluster node root volumes\n\nYou specify keys in your management service, cluster, and node pool\nconfiguration.\n\nPrerequisites\n-------------\n\nTo use customer managed CMK for GKE on AWS root volumes, you need the following:\n\n- Permissions to create or use an AWS KMS key policy. For more information, see [Using key policies in AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html).\n\nCreate a key policy\n-------------------\n\nYour AWS KMS keys must have a key policy that allows GKE on AWS to\ncreate and read volumes encrypted with a customer managed CMK. An example policy\nis provided in the following section. To create the policy, perform the\nfollowing the steps:\n\n1. From your `anthos-aws` directory, use\n `terraform` to get the ID of your management service.\n\n ```sh\n cd anthos-aws\n terraform output cluster_id\n ```\n The output includes your management service ID. In the example below, the ID is `gke-12345abc`. \n\n terraform output cluster_id\n gke-12345abc\n\n \u003cbr /\u003e\n\n2. [Create an AWS KMS key policy](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html)\n with the following contents:\n\n {\n \"Version\": \"2012-10-17\",\n \"Id\": \"key-consolepolicy-3\",\n \"Statement\": [\n {\n \"Sid\": \"Enable IAM User Permissions\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::\u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e:root\"\n },\n \"Action\": \"kms:*\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow creating encrypted EBS volumes for EC2 use\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": [\n \"arn:aws:iam::\u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e:role/gke-\u003cvar translate=\"no\"\u003eCLUSTER_ID\u003c/var\u003e-management\",\n \"arn:aws:iam::\u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e:user/\u003cvar translate=\"no\"\u003eAWS_USER\u003c/var\u003e\",\n \"arn:aws:iam::\u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling\"\n ]\n },\n \"Action\": [\n \"kms:GenerateDataKeyWithoutPlaintext\",\n \"kms:Decrypt\"\n ],\n \"Resource\": \"*\",\n \"Condition\": {\n \"StringEquals\": {\n \"kms:CallerAccount\": \"\u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e\",\n \"kms:ViaService\": \"ec2.\u003cvar translate=\"no\"\u003eAWS_REGION\u003c/var\u003e.amazonaws.com\"\n }\n }\n },\n {\n \"Sid\": \"Allow attaching encrypted EBS volumes for EC2 Use\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": [\n \"arn:aws:iam::\u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e:role/\u003cvar translate=\"no\"\u003eCLUSTER_ID\u003c/var\u003e-management\",\n \"arn:aws:iam::\u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e:role/\u003cvar translate=\"no\"\u003eCLUSTER_ID\u003c/var\u003e-controlplane\",\n \"arn:aws:iam::\u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling\"\n ]\n },\n \"Action\": [\n \"kms:CreateGrant\",\n \"kms:ListGrants\",\n \"kms:RevokeGrant\"\n ],\n \"Resource\": \"*\",\n \"Condition\": {\n \"StringEquals\": {\n \"kms:CallerAccount\": \"\u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e\",\n \"kms:ViaService\": \"ec2.\u003cvar translate=\"no\"\u003eAWS_REGION\u003c/var\u003e.amazonaws.com\"\n }\n }\n }\n ]\n }\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eACCOUNT_NUMBER\u003c/var\u003e: your AWS account number--- for example, `1234567890`.\n - \u003cvar translate=\"no\"\u003eCLUSTER_ID\u003c/var\u003e: your GKE on AWS management cluster ID--- for example `gke-12345678`.\n - \u003cvar translate=\"no\"\u003eAWS_USER\u003c/var\u003e: your AWS user name.\n - \u003cvar translate=\"no\"\u003eAWS_REGION\u003c/var\u003e: The AWS region where your GKE on AWS clusters run--- for example `us-east1`.\n\nConfiguring resources to use a customer managed CMK\n---------------------------------------------------\n\nThis section explains how to configure customer managed CMK for\nGKE on AWS components. Before upgrading existing components, see\n[Using CMK with existing clusters](#upgrade-existing).\n\n### Bastion host and management service\n\nYou configure a customer managed CMK for your bastion host root volume,\nmanagement service root volume, and management service etcd data volumes in your\n`anthos-gke.yaml` before setting up the management service. For more\ninformation, see,\n[Integrating existing infrastructure](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/integrating-existing-infrastructure)\nand the\n[AWSManagementService](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/awsmanagementservice#rootvolume)\nreference.\n\n### User cluster control plane volumes\n\nYou configure a customer managed CMK for your user cluster control plane and\netcd data volumes in your [AWSCluster](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/awscluster)\ndefinition. For more information, see\n[Creating a custom user cluster](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/creating-custom-user-cluster).\n\n### User cluster node root volumes\n\nYou configure a customer managed CMK on user cluster node root volumes in your\n[AWSNodePool](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/awsnodepools)\ndefinition. For more information, see\n[Creating a custom user cluster](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/creating-custom-user-cluster).\n\n### Using CMK with existing clusters\n\n| **Caution:** If you enable a customer managed CMK on an existing management service or user cluster control plane *etcd* data volume, you will lose cluster configuration. To encrypt etcd data volumes, you must create a new management service or user clusters.\n\nYou can add customer managed CMK configuration to the following existing\ncomponents:\n\n- Bastion host root volume\n- Management service root volumes\n- User cluster control plane root volumes\n- User cluster node root volumes\n\nGKE on AWS recreates these volumes after an upgrade or configuration\nchange. To add customer managed CMK configuration to existing components,\nfollow the instructions in\n[Upgrading GKE on AWS](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/upgrading). When you\nmodify your resource configuration, modify the following fields:\n\nWhen you complete the upgrade, GKE on AWS creates new resources with\nthe customer managed CMK volumes attached.\n\nWhat's next\n-----------\n\n- [Create a custom user cluster](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/creating-custom-user-cluster).\n- [Upgrade GKE on AWS](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/upgrading)"]]
