Baro sida loo diyaariyo AWS loona hawlgeliyo Maamulka Furayaasha Shirkadda (EKM).

Guudmar

Enterprise Key Management (EKM) waxay OpenAI u oggolaanaysaa inay xogta ku sirgeliso fure master ah oo aad adigu maamusho. Dukumentigan wuxuu muujinayaa sida loo dejiyo akoonkaaga AWS si OpenAI loo siiyo rukhsado xaddidan oo ku saabsan KMS-kaaga.

AWS EKM integration flow between OpenAI EKM Service, your STS, your KMS, and your master KEK

Tallaabooyinka

1. Samee fure KMS oo cusub

Tag KMS > Furayaasha uu macmiilku maamulo, dabadeed dooro Samee fure.
Dooro hab sirgelin oo isla furaha u adeegsada sirgelinta iyo furfurista.
Marka furahaaga la sameeyo, qor ARN-kiisa. Qaababka la taageero waxaa ka mid ah arn:aws:kms:<region>:<account_number>:key/<uuid>, ...:key/mrk-*, ama ...:alias/<alias_name>.

AWS KMS customer managed key details page with key ID and ARN for test-kms

2. Samee siyaasad gaar ah oo xaddidaysa gelitaanka furaha KMS

Tag IAM > Siyaasadaha, dabadeed dooro Samee siyaasad.
Tallaabada Qeex oggolaanshaha, dooro JSON oo geli waxa soo socda si aad siyaasadda ugu darto hawlaha gelitaanka KMS. Hubi inaad YOUR_KMS_ARN ku beddesho ARN-ka furaha aad samaysay.

AWS IAM Create policy page with Specify permissions open and the JSON policy editor selected

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowEncryptDecrypt",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:Encrypt"
            ],
            "Resource": "<YOUR_KMS_ARN>"
        }
    ]
}

3. Samee door IAM ah oo OpenAI qaadan karto, kuna xidh siyaasadda xaddidaysa gelitaanka KMS-kaaga

OpenAI waxay AssumeRole ka wici doontaa koonto AWS ah oo ay leedahay. Tallaabadani waxay aqoonsiga AWS ee OpenAI u oggolaanaysaa inuu qaato doorka xaddidan ee gelitaanka KMS-kaaga.

Tag IAM > Doorarka, dabadeed dooro Samee door.
Tallaabada Dooro cid la aamini karo, dooro Siyaasad aaminaad oo gaar ah.

AWS IAM Select trusted entity screen with Custom trust policy selected

Marka xigta, geli waxa soo socda qaybta Siyaasad aaminaad oo gaar ah si aad gelitaanka ugu oggolaato aqoonsiga AWS ee OpenAI.

Aqoonsiga la adeegsanayo waa aqoonsiga AWS ee OpenAI: arn:aws:iam::790389265272:role/EnterpriseKeyManagement.
Sheeg ExternalId ay tahay inay OpenAI gudbiso inta lagu jiro habka AssumeRole.
- ChatGPT ama API, isticmaal Aqoonsiga Ururka (org-xxx) ee ku xidhan goobta shaqada ee aad leedahay: dejimaha ururka.
- API-ga, waxaad isticmaali kartaa aqoonsiga mashruuc API oo gaar ah si aad xakamaynta u sii faahfaahiso.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::790389265272:role/EnterpriseKeyManagement"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": [
                         "<YOUR_OPENAI_ORGANIZATION_ID>"
                     ]
                }
            }
        }
    ]
}

Dabadeed, tallaabada Ku dar oggolaansho, raadi magaca siyaasadda IAM ee aad ku samaysay tallaabadii hore. Calaamadee sanduuqa xulashada ee ku xiga magaca siyaasadda, dabadeed dooro Xiga.

AWS IAM Add permissions page filtered to customer managed KMS policies with test-allow-kms-access selected

Ugu dambayn, qaybta Magac u bixi, dib u eeg oo samee, dooro magac kasta oo aad doorka u rabto.

4. Ku dabaq xaddidaad kasta oo dheeraad ah si waafaqsan hab-dhaqannadaada amniga

Kor ku xusan waa macluumaadka ugu yar ee loo baahan yahay ee OpenAI u baahan tahay si ay EKM u dejiso. Waxaad xor u tahay inaad dabaqdo siyaasado fure ama xaddidaadyo dheeraad ah oo waafaqsan hab-dhaqannadaada amni ee gudaha, inta OpenAI awood u leedahay inay ku wacdo hawlgallada sirgelinta iyo furfuridda sirta KMS-kaaga. Markaad wacdo bar-dhammaadka diiwaangelinta furaha ee OpenAI ee hoos lagu sharraxay, waxaan xaqiijin doonaa dejintaada.

Kadib markaad dhammeystirto tallaabooyinka kore

ChatGPT Enterprise

Fadlan la xiriir xiriirkaaga OpenAI oo la wadaag kuwan soo socda:

"role_arn": "arn:aws:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>"
- Role ARN-ka uu OpenAI ka qaadan doono daruurtaada.
"kms_arn": "arn:aws:kms:<REGION>:<YOUR_AWS_ACCOUNT_NUMBER>:key/<UUID>"
- ARN-ka Key Management System ee furaha master-ka ah ee aad maamusho.

Waxaan EKM u hawlgelin doonaa ururka/goobta shaqadaada ChatGPT.

API

Ka diiwaangeli furahaaga dibadeed OpenAI

Raac tilmaamaha ku jira tixraacan API-ga: Furayaasha Dibadeed ee API-ga Maamulka.

Marka hore, ka diiwaangeli furahaaga dibadeed heerka ururka OpenAI; taasi waxay soo saari doontaa aqoonsiga furaha dibadeed.
Tallaabadan, waxaan hubin doonnaa in xogta aad gelisay sax tahay iyo inaan aqoonsigeenna ka xaqiijin karno KMS-kaaga.
Tani weli EKM kuma dari doonto mashruucaaga OpenAI.

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/external_keys" \
-d '{
  "type": "aws",
  "name": "AWS EKM Config",
  "role_arn": "arn:aws:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>",
  "kms_arn": "arn:aws:kms:<REGION>:<YOUR_AWS_ACCOUNT_NUMBER>:key/<UUID>",
  "external_id": "<your org id or project id>"
}'

Kadib, samee mashruuc OpenAI oo la xiriira furaha dibadda. Intaas ka dib, EKM waxaa laga hawlgeliyaa mashruucaaga. Jirka jawaabta ee wicitaankan API-ga ayaa ku siin doona aqoonsiga mashruuca (proj_xxx).

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/projects" \
-d '{
   "name": "Some Project",
   "external_key_id": "extkey_xxxx"
}'

Dejinta EKM iyadoo la adeegsanayo OpenAI iyo AWS