AWS
Ora duwe wewenang kanggo nindakake: sts:AssumeRole
Pangguna: arn:aws:sts::xxxxx:assumed-role/EnterpriseKeyManagement/OpenAI-EKM-Service ora duwe wewenang kanggo nindakake: sts:AssumeRole ing sumber daya: arn:aws:iam::xxxxx:role/xxxxxxPriksa principal lan ExternalId ing trust policy sampeyan
Prasthekake sampeyan wis ngetutake bagean dokumentasi iki, kalebu LORO-LORONE yaiku ngakoni principal OpenAI lan ngonfigurasi sts:ExternalId
Yen sampeyan wis masang sts:ExternalId, prasthekake iku ID organisasi OpenAI sing padha sing sampeyan terapake EKM, dudu org liyane kayata org pribadi.
Priksa asosiasi trust policy karo role ARN
Priksa manawa trust policy wis disimpen kanthi bener menyang role ARN sing wis sampeyan wenehake
Uga priksa manawa sampeyan wis menehi role ARN sing bener. Yen ARN sampeyan salah tulis lan ora ana, kita bakal entuk error sing padha kaya nalika peran ana nanging nolak idin.
Ora duwe wewenang kanggo nindakake: kms:Encrypt ing sumber daya
Pangguna: xxxxx ora duwe wewenang kanggo nindakake: kms:Encrypt ing sumber dayaPrasthekake IAM policy sampeyan menehi kms:Encrypt lan kms:Decrypt marang role OpenAI.
Yen sampeyan uga wis nambah key policy, prasthekake iku uga menehi kms:Encrypt lan kms:Decrypt marang role OpenAI.
GCP
Gagal njupuk token GCP STS kanggo audience
Gagal njupuk token GCP STS kanggo audience //iam.googleapis.com/projects/xxxxxxxxx/locations/global/workloadIdentityPools/xxxxxxx/providers/xxxxxxxxxx: {'error': 'invalid_request', 'error_description': 'Nilai ora valid kanggo \"audience\". Nilai iki kudune jeneng resource lengkap saka Identity Provider. Delengen https://cloud.google.com/iam/docs/reference/sts/rest/v1/TopLevel/token kanggo dhaptar format sing bisa digunakake.GCP ngarepake audience nganggo format
iam.googleapis.com/projects/xxxxxxxxx/locations/global/workloadIdentityPools/xxxxxxx/providers/xxxxxxxxxx
Prasthekake sampeyan wis menehi parameter sing bener nalika ndhaptar kunci karo OpenAI nganggo Kunci Eksternal ing Management API
Prasthekake workload_identity_project_number iku nomer proyek GCP 12 digit
Prasthekake workload_identity_pool_id bener
Prasthekake workload_identity_provider_id bener
Audience ing ID token ora cocog karo audience sing dikarepake
Gagal njupuk token GCP STS kanggo audience //iam.googleapis.com/projects/xxxxxx/locations/global/workloadIdentityPools/xxxxxxx/providers/xxxxxxxx: {'error': 'invalid_grant', 'error_description': 'Audience ing ID Token [xxxxx] ora cocog karo audience sing dikarepake xxxxxxx.'}Prasthekake kolom audience sing sampeyan wenehake nalika ndhaptar config karo OpenAI (Kunci Eksternal ing Management API ) ana ing salah siji Allowed Audiences kanggo workload identity provider sampeyan. Disaranake nggunakake ID organisasi OpenAI sampeyan.
Azure
Aplikasi klien ora duwe service principal
Aplikasi klien xxxxx ora duwe service principal ing tenant xxxxx. Delengen pandhuane ing kene: https://go.microsoft.com/fwlink/?linkid=2225119Prasthekake sampeyan wis ngetutake kanthi bener nggawe service principal kaya sing diterangake ing Pandhuan Integrasi OpenAI / Azure EKM.
Pemanggil ora duwe wewenang kanggo nindakake tumindak ing sumber daya
Pemanggil ora duwe wewenang kanggo nindakake tumindak ing sumber daya. Yen role assignments, deny assignments, utawa role definitions bubar diganti, enteni wektu propagasi.Error sing padha iki bisa muncul amarga sawetara sebab
Sampeyan menehi jeneng kunci utawa URI vault sing salah, utawa sing ora ana
Sampeyan durung nggawe peran nganggo aksi data iki LAN menehi peran kasebut menyang service principal OpenAI
Microsoft.KeyVault/vaults/keys/encrypt/action
Microsoft.KeyVault/vaults/keys/decrypt/action
Jeneng kunci ora cocog karo pola
"'key_name' ora valid: string ora cocog karo pola. Sing dikarepake yaiku string sing cocog karo pola '^org-[0-9a-zA-Z-]*--[0-9a-zA-Z-]*$'."Wenehana prefiks jeneng kunci Key Vault nganggo ID organisasi OpenAI sampeyan.
Iki praktik paling apik sing disaranake keamanan kanggo nyegah kunci key vault sampeyan didaftarke dening pangguna liyane. Kita validasi manawa org id cocog nalika registrasi kunci lan ing saben panjaluk menyang key vault sampeyan.