Ringkesan

Enterprise Key Management (EKM) ngidini OpenAI ngenkripsi data nggunakake kunci master sing sampeyan kontrol. Dokumen iki nuduhake carane nyiyapake akun AWS sampeyan kanggo menehi idin winates marang OpenAI ing KMS sampeyan.

AWS EKM integration flow between OpenAI EKM Service, your STS, your KMS, and your master KEK

Langkah-langkah

1. Gawe kunci KMS anyar

Pindhah menyang KMS -> Kunci sing dikelola pelanggan, banjur klik Gawe Kunci.
Pilih algoritma enkripsi simetris.
Sawise kunci sampeyan digawe, cathet ARN kanggo kunci kasebut. Format sing didhukung kalebu arn:aws:kms:<region>:<account_number>:key/<uuid>, ...:key/mrk-*, utawa ...:alias/<alias_name>.

AWS KMS customer managed key details page with key ID and ARN for test-kms

2. Gawe kabijakan khusus kanggo akses winates menyang kunci KMS

Pindhah menyang IAM -> Policies, banjur klik Gawe Kabijakan.
Ing langkah Tetepake idin, pilih JSON lan lebokna ing ngisor iki kanggo menehi tumindak akses KMS marang kabijakan kasebut. Pesthekake sampeyan ngganti YOUR_KMS_ARN nganggo ARN saka Kunci sing wis sampeyan gawe.

AWS IAM Create policy page with Specify permissions open and the JSON policy editor selected

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowEncryptDecrypt",
            "Effect": "Allow",
            "Action": [

                "kms:Decrypt",
                "kms:Encrypt"

            ],
            "Resource": <YOUR_KMS_ARN>
        }
    ]
}

3. Gawe Peran IAM kanggo diasumsi OpenAI, lan pasangake menyang kabijakan kanthi akses winates menyang KMS sampeyan

OpenAI bakal nelpon AssumeRole saka akun AWS sing diduweni OpenAI. Langkah iki ngidini principal AWS OpenAI ngasumsi role winates kanggo ngakses KMS sampeyan.

Pindhah menyang IAM -> Roles, banjur klik Gawe Role.
Ing langkah Pilih entitas tepercaya, pilih Kabijakan kapercayan khusus.

AWS IAM Select trusted entity screen with Custom trust policy selected

Sabanjure, lebokna ing ngisor iki ing Kabijakan kapercayan khusus kanggo ngidini akses menyang principal AWS OpenAI.

Principal kasebut yaiku principal AWS OpenAI: arn:aws:iam::790389265272:role/EnterpriseKeyManagement.
Tuduhake ExternalId sing kudu diterusake OpenAI sajrone proses AssumeRole.
- Kanggo ChatGPT utawa API, gunakake ID organisasi (org-xxx) sing gegandhengan karo papan kerja sampeyan: https://platform.api.openai.org/settings/organization/general.
- Kanggo API, sampeyan bisa nggunakake ID proyek API tartamtu supaya luwih rinci.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::790389265272:role/EnterpriseKeyManagement"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": [
                         <YOUR_OPENAI_ORGANIZATION_ID>,
                     ]
                }
            }
        }
    ]
}

Banjur, ing langkah Tambah idin, goleki jeneng kabijakan IAM sing digawe ing langkah sadurunge. Klik kothak centhang ing jejere jeneng kabijakan, banjur klik Sabanjure.

AWS IAM Add permissions page filtered to customer managed KMS policies with test-allow-kms-access selected

Pungkasan, ing bagean Jeneng, deleng maneh, lan gawe, pilih jeneng role apa wae.

4. Terapake watesan tambahan apa wae selaras karo praktik keamanan sampeyan dhewe

Ing ndhuwur yaiku informasi minimal sing dibutuhake OpenAI kanggo nyiyapake EKM. Sampeyan bebas ngetrapake kabijakan utawa watesan kunci tambahan sing selaras karo praktik keamanan internal sampeyan dhewe, anggere OpenAI bisa nelpon operasi enkripsi lan dekripsi ing KMS sampeyan. Nalika sampeyan nelpon titik pungkasan registrasi kunci karo OpenAI sing diterangake ing ngisor iki, kita bakal validasi panyiyapan sampeyan.

Sawise ngrampungake langkah-langkah ing ndhuwur

ChatGPT Enterprise

Mangga hubungi kontak OpenAI sampeyan lan bagikna ing ngisor iki:

"role_arn": "arn:aws:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>"
- Role ARN sing bakal diasumsi OpenAI ing cloud sampeyan.
"kms_arn": "arn:aws:kms:<REGION>:<YOUR_AWS_ACCOUNT_NUMBER>:key/<UUID>"
- ARN Key Management System kanggo kunci master sing sampeyan kelola.

Kita bakal ngaktifake EKM kanggo organisasi/papan kerja ChatGPT sampeyan.

API

Daftaraké kunci eksternal sampeyan karo OpenAI

Tindakake pandhuan ing referensi API iki: Kunci Eksternal ing API Manajemen.

Pisanan, daftaraké kunci eksternal sampeyan ing tingkat organisasi OpenAI, sing bakal ngasilake ID kunci eksternal.
Ing langkah iki, kita bakal validasi manawa input sampeyan valid lan kita bisa autentikasi menyang KMS sampeyan.
Iki durung bakal nambah EKM menyang proyek OpenAI sampeyan.

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \

"https://api.openai.com/v1/organization/external_keys" \
-d '{
  "type": "aws",
  "name": "AWS EKM Config",
  "role_arn": "arn:aws:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>",
  "kms_arn": "arn:aws:kms:<REGION>:<YOUR_AWS_ACCOUNT_NUMBER>:key/<UUID>",
  "external_id": <your org id or project id>
}'

Banjur, gawe proyek OpenAI sing gegandhengan karo kunci eksternal kasebut. Sawise iki, EKM diaktifake ing proyek sampeyan. Isi respons saka panggilan API iki bakal menehi ID proyek (proj_xxx) marang sampeyan.

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/projects" \
-d '{
   "name": "Some Project",

   "external_key_id": "extkey_xxxx"
}'

Pandhuan Integrasi OpenAI / AWS EKM