Ntụgharị igodo ukwu na igodo mbinye aka, na ịnweta mberede

Njikwa dị na 21-compliance.md ngalaba 14 nke onye nyocha na-ajụ aha ya. Ibe a bụ usoro; ndekọ ọ na-emepụta bụ ihe akaebe.

Igodo ndị ahụ

A na-eji igodo nzuzo data ọhụrụ (DEK) mechie nzere ọ bụla echekwara. A na-ekekọta DEK ahụ na igodo ukwu (KEK), a na-echekwa nrụtụ aka igodo ukwu ahụ n’akụkụ ya (key_ref, ma ọ bụ nrụtụ aka dị n’ime uru akwakọbara). Ịtụgharị igodo ukwu na-ekekọtaghachi DEK ndị ahụ. Ọ dịghị mgbe ọ na-ewepu nzuzo na nzere ma ọ bụ tinyeghachi nzere na nzuzo ọzọ.

Ọkwa weebụ, worker na iwu bun run kek:rotate na-agụ otu ntọala atọ ahụ. Ha niile ga-enwerịrị otu ụkpụrụ, ma ọ bụghị ya, otu n’ime ha enweghị ike imepe ihe ọzọ mechiri.

Na-enweghị QUIRE_MASTER_KEY akụkụ ọ bụla na-edobe igodo ọ na-enweta site na QUIRE_SECRET_KEY. Nke ahụ na-arụ ọrụ, ibe ahụike Sistemụ na-egosi ya dịka adịghị mma, ọ na-anọgide na-agụ mgbe ị tọchara igodo ukwu, nke bụ otu ntụgharị mbụ si ebuga ihe niile pụọ na ya. Onye ọ bụla nwere ike ịgụ gburugburu usoro nwere ike iwepu nzuzo na nzere ọ bụla echekwara, ya mere nrụnye mmepụta kwesịrị inwe igodo ukwu, echekwara na ụlọ ahịa nzuzo ọ bụghị n’otu ndabere dịka nchekwa data.

Ịtụgharị

Afọ igodo na-egosi na console Platform, Nche, Igodo ukwu, na dịka metric quire.secrets.master_key.age (ụbọchị). Nhazi platform.key_age kwa ụbọchị (03:41 UTC) na-ede ndenye ncheta na agbụ nyocha platform mgbe igodo ruru ụbọchị 365, na ọzọ kwa ụbọchị 30 ruo mgbe a tụgharịrị ya. Tụgharịa na ncheta, na mgbe ọ bụla igodo nwere ike ekpugharịrị.

1. Mepụta igodo ọhụrụ: openssl rand -base64 32.
2. Tọọ QUIRE_MASTER_KEY na ya na QUIRE_MASTER_KEY_VERSION na akara na-esote (v2). Bugharịa igodo ochie na QUIRE_MASTER_KEY_RETIRED dịka v1=<old base64>. Debe otu nke abụọ n’ebe ọzọ na-abụghị họst a.
3. Bunye ọkwa weebụ na worker na ntọala ọhụrụ. A na-ekekọta nzuzo ọhụrụ ugbu a n’okpuru env:QUIRE_MASTER_KEY:v2; ndị ochie ka na-emeghe site na igodo lara ezumike nká.
4. Rịọ ntụgharị ahụ, na ihe kpatara ya ga-anọdụ na ụzọ nyocha:
   • na console: Nche, Igodo ukwu, Tụgharịa igodo ukwu; ma ọ bụ
   • na sheel nwere otu gburugburu: bun run kek:rotate request --reason "Annual rotation, ticket SEC-114".
5. Worker na-ekekọtaghachi iberi n’otu nkeji (nhazi platform.key_rotation nke onye nhazi oge) wee gaa n’ihu mgbe ịmalitegharị. Imecha ya n’otu oche: bun run kek:rotate run. Lelee ya na bun run kek:rotate status.
6. Mgbe ndekọ gosiri ntụgharị mechara na efu a na-edozibeghị na efu dara, wepụ igodo lara ezumike nká na QUIRE_MASTER_KEY_RETIRED wee bunyekwa ọzọ. Ruo mgbe ahụ debe ya: uru ọ na-enweghị ike ibugharị ka nọ n’okpuru igodo ochie.

Ihe ọrụ ahụ na-agagharị

Ụlọ ahịa ọ bụla na-ejide DEK ekekọtara: ndị dị na SEALED_STORES (apps/worker/src/key-rotation.ts). A na-agagharị ụlọ ahịa nchekwa data njikwa na nchekwa data njikwa; a na-agagharị ụlọ ahịa otu n’otu otu n’okpuru nchebe ọkwa ahịrị, na nchekwa data ọ bụla na-ejide otu ahụ, ya mere tenant a tụkwasịrị na nchekwa data raara onwe ya ka a na-atụgharị na nchekwa data ahụ. Ule dara mgbe schema nwetara kọlụm igodo ekekọtara nke ndepụta akpọghị aha, na nke ọzọ mgbe nyocha nzere kewara kọlụm mechiri emechi nke ndepụta ahụ agbagharala.

Ndekọ ahụ

• ops.key_rotation: otu ahịrị kwa ntụgharị, na ihe kpatara ya, onye rịọrọ ya, ọnọdụ ya na ngụkọta ya (ekekọtaghachiri, dị ugbu a, a na-edozibeghị, dara).
• ops.key_rotation_progress: otu ahịrị kwa ụlọ ahịa na oke ozugbo agagharịrị, na nrụtụ aka igodo ọ na-enweghị ike ịgụ na ọnụọgụ ụkpụrụ nọ n’okpuru nke ọ bụla. Ntụgharị amalitegharịrị na-awụli ndị a.
• Agbụ nyocha platform: platform/key_rotation_request (na ihe kpatara ya), otu platform/key_rotation_store kwa ụlọ ahịa na ngụkọta ya, na platform/key_rotation_complete ma ọ bụ platform/key_rotation_fail; platform/key_age_reminder maka ncheta.
• Metrics: quire.secrets.master_key.age na quire.secrets.rewrap.outstanding (ụkpụrụ ntụgharị ikpeazụ na-enweghị ike ibugharị).

Mgbe ụkpụrụ na-edozibeghị

Uru a na-edozibeghị nọ n’okpuru nrụtụ aka igodo nke nrụnye a enweghị, ma ọ bụ na-anọghị n’ụdị kọlụm ya kwere nkwa. Ndekọ ọganihu na-akpọ nrụtụ aka ahụ (dịka ọmụmaatụ env:QUIRE_MASTER_KEY:v0 (unreadable)). Weghachite igodo ahụ na QUIRE_MASTER_KEY_RETIRED wee gbaa ntụgharị ọzọ, ma ọ bụ, ọ bụrụ na igodo ahụ apụọla kpamkpam, mee ka onye nchịkwa otu ahụ tinyegharịa nzere ahụ: a na-emechi ya n’okpuru igodo dị ugbu a. Ntụgharị dara na-egosi njehie ya na ndekọ; dozie ihe kpatara ya wee rịọ ọzọ.

Igodo mbinye aka

Dị iche na igodo ukwu: otu ọ bụla na-ebinye aka na token OpenID Connect ya na ozi LTI na igodo RSA nke ya, ebipụtara na /.well-known/jwks.json. Ọ dịghị ihe ebe a chọrọ onye na-arụ ọrụ. Nhazi platform.signing_keys kwa elekere na-ebipụta onye nọchiri ụbọchị asaa tupu ụbọchị iri itoolu nke igodo dị ugbu a agwụ, otu izu emesịa onye nọchiri amalite ibinye aka na igodo ochie aghọọ nke na-ala ezumike nká, na ụbọchị iri itoolu mgbe ahụ a na-ehichapụ igodo ochie wee pụọ na nhazi igodo. Nzọụkwụ ọ bụla bụ ndenye platform/signing_key_advance na agbụ nyocha platform.

Iji dochie igodo otu n’oge, dịka ọmụmaatụ mgbe ekpughere ya:

• na console: Nche, Igodo ukwu, Bipụta igodo mbinye aka ọhụrụ (chọrọ platform/keys_manage); ma ọ bụ
• na sheel nwere gburugburu worker: bun run kek:rotate signing-keys rotate --tenant <slug or id> --reason "Key exposed, INC-3310". bun run kek:rotate signing-keys status na-edepụta igodo otu ọ bụla site na ọkwa.

Igodo ọhụrụ na-ebipụta ozugbo wee malite ibinye aka mgbe ụbọchị asaa gachara, mgbe igodo dị ugbu a lara ezumike nká. Izu ahụ bụ ebumnuche: ndị na-adabere na ya na-echekwa nhazi igodo, na nkwekọrịta dị mkpụmkpụ na-ada ngwaọrụ ọ bụla n’otu oge. Igodo na-ala ezumike nká na-anọ na nhazi igodo maka ụbọchị iri itoolu ọzọ ka token ọ binyelarị aka na-aga n’ihu na-enyocha; ọ bụrụ na ekpughere pụtara na ọ ga-akwụsị ịtụkwasị obi ngwa ngwa, ihichapụ ahịrị ya bụ mgbanwe ejiri nweta nchekwa data nke onye na-arụ ọrụ n’onwe ya mee n’okpuru ndekọ mgbanwe (ịnweta mberede bụ naanị ọgụgụ), token ejiri ya binye aka na-ada nkwenye. Ntụgharị amanye bụ platform/signing_key_rotate na agbụ nyocha, na ihe kpatara ya. Worker chọrọ otu ntọala QUIRE_MASTER_KEY dịka ọkwa weebụ iji kechie igodo ọhụrụ; bun run kek:rotate maka igodo ukwu na-ekekọtaghachi igodo mbinye aka na ihe niile ọzọ (oauth_signing_key dị na SEALED_STORES).

Ịnweta mmepụta mberede

Ọ dịghị onye na-ejide ohere guzoro na mmepụta. Mgbe ihe enweghị ike ichere, onye nwe na-enye onyinye mberede: console Platform, Nche, Ịnweta mberede.

• Onyinye nwere oke (otu otu, ma ọ bụ ndekọ platform), ihe kpatara ya nke dịkarịa ala mkpụrụedemede 20 na-akpọ ihe merenụ ma ọ bụ tiketi, na windo nkeji 5 ruo 240. Ọ na-agwụ n’onwe ya: a na-enyocha ya megide elekere na nkwupụta ọ bụla.
• Enwere ike inye ya onye nwe nyere ya, ma ọ bụ onye nwe ọzọ (ụdị mmadụ abụọ). Naanị onye e nyere ya nwere ike iji ya. Inye chọrọ platform/break_glass_issue iji chọrọ platform/break_glass_use; ha abụọ bụ naanị onye nwe na ndabara.
• Nkwupụta na-aga site na ọnụ ụzọ, ọ bụghị na nbanye nchekwa data: naanị ọgụgụ, otu n’otu oge, amachibidoro na otu ma ọ bụ na ndekọ njikwa, na timeout sekọnd ise na karịa ahịrị 500. A na-egosi ụkpụrụ binary site na nha.
• Agbụ nyocha platform na-edekọ inye (na ihe kpatara ya), kagbuo, nkwupụta ọ bụla tupu ọ gbaa (platform/break_glass_statement, ndị jụrụ na nsonaazụ denied) na nsonaazụ ọ bụla (platform/break_glass_result). ops.break_glass_statement na-ejide id ndenye nyocha, ya mere ndekọ inye na-ejikọta na ndenye nyocha ya.
• Anaghị enye ederede. Mgbanwe na-enweghị ike ichere mwepụta na-eji nweta nchekwa data nke onye na-arụ ọrụ n’onwe ya n’okpuru ndekọ mgbanwe nke ya, n’èzí ngwaahịa a, ndekọ ahụ kwesịrị ịkpọ nrụtụ aka ihe merenụ ejiri ebe a.

Ihe mere na anaghị enye nzere nchekwa data: nbanye Postgres na-adị ndụ karịa oge jụrụ ya, na-agafe nchebe ọkwa ahịrị nke ngwa dabere na ya, na enweghị ike ide na agbụ nyocha ngwaahịa a, ya mere a ga-enyocha nkwupụta ya naanị ka mmadụ bugara log sava. Ọnụ ụzọ na-eme ụzọ nyocha ka ọ bụrụ ihe onwunwe nke ịnweta kama omume gbara ya gburugburu.

Iji zaa arịrịọ nyocha: depụta onyinye dị n’oge ahụ (Ịnweta mberede), mepee akụkọ onyinye maka nkwupụta ya na id ndenye nyocha, ma gụọ ndị ahụ ndenye na agbụ nyocha platform (bun run audit:verify --platform gosipụtara na agbụ ahụ adịghị emebi).