Guudmar

Enterprise Key Management (EKM) waxay OpenAI u oggolaanaysaa inay xogta ku sirgeliso fure master ah oo aad adigu maamusho. Dukumentigan wuxuu muujinayaa sida loo dejiyo akoonkaaga AWS si OpenAI loo siiyo rukhsado xaddidan oo ku saabsan KMS-kaaga.

AWS EKM integration flow between OpenAI EKM Service, your STS, your KMS, and your master KEK

Tallaabooyinka

1. Samee fure KMS cusub

Tag KMS -> Furayaasha uu macmiilku maamulo, kadib guji Abuur Fure.
Dooro algorithim sirgelin simmetri ah.
Kadib marka furahaaga la abuuro, qor ARN-kiisa. Qaababka la taageero waxaa ka mid ah arn:aws:kms:<region>:<account_number>:key/<uuid>, ...:key/mrk-*, ama ...:alias/<alias_name>.

AWS KMS customer managed key details page with key ID and ARN for test-kms

2. Samee siyaasad gaar loo habeeyey oo xaddidaysa gelitaanka furaha KMS

Tag IAM -> Siyaasadaha, kadib guji Abuur Siyaasad.
Tallaabada Cayim rukhsadaha, dooro JSON oo geli kuwan soo socda si siyaasadda loo siiyo falalka gelitaanka KMS. Hubi inaad YOUR_KMS_ARN ku beddesho ARN-ka Furaha aad abuurtay.

AWS IAM Create policy page with Specify permissions open and the JSON policy editor selected

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowEncryptDecrypt",
            "Effect": "Allow",
            "Action": [

                "kms:Decrypt",
                "kms:Encrypt"

            ],
            "Resource": <YOUR_KMS_ARN>
        }
    ]
}

3. Samee IAM Role uu OpenAI qaadan karo, kuna xiro siyaasadda gelitaan xaddidan ku leh KMS-kaaga

OpenAI waxay AssumeRole ka wici doontaa akoon AWS oo ay OpenAI leedahay. Tallaabadani waxay u oggolaanaysaa principal-ka AWS ee OpenAI inuu qaato doorka xaddidan si uu u galo KMS-kaaga.

Tag IAM -> Doorarka, kadib guji Abuur Door.
Tallaabada Dooro hay'ad la aamini karo, dooro siyaasad kalsooni gaar loo habeeyey.

AWS IAM Select trusted entity screen with Custom trust policy selected

Marka xiga, geli kuwan soo socda siyaasadda kalsoonida gaar loo habeeyey si loogu oggolaado gelitaanka principal-ka AWS ee OpenAI.

Principal-ku waa principal-ka AWS ee OpenAI: arn:aws:iam::790389265272:role/EnterpriseKeyManagement.
Sheeg ExternalId uu OpenAI gudbinayo inta lagu jiro habka AssumeRole.
- ChatGPT ama API, isticmaal aqoonsiga ururka (org-xxx) ee la xiriira goobta shaqadaada: https://platform.api.openai.org/settings/organization/general.
- API-ga, waxaad isticmaali kartaa aqoonsi mashruuc API gaar ah si faahfaahin dheeraad ah loo helo.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::790389265272:role/EnterpriseKeyManagement"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": [
                         <AQOONSIGA_URURKAAGA_OPENAI>,
                     ]
                }
            }
        }
    ]
}

Kadib, tallaabada Ku dar rukhsadaha, raadi magaca siyaasadda IAM ee aad ku abuurtay tallaabadii hore. Guji sanduuqa calaamadeynta ee ku xiga magaca siyaasadda, kadib guji Xiga.

AWS IAM Add permissions page filtered to customer managed KMS policies with test-allow-kms-access selected

Ugu dambayn, qaybta Magaca, dib-u-eegista, iyo abuurista, dooro magac door oo kasta.

4. Ku dabaq xaddidaad kasta oo dheeraad ah si waafaqsan hab-dhaqannadaada amniga

Kor ku xusan waa macluumaadka ugu yar ee loo baahan yahay ee OpenAI u baahan tahay si ay EKM u dejiso. Waxaad xor u tahay inaad dabaqdo siyaasado fure ama xaddidaadyo dheeraad ah oo waafaqsan hab-dhaqannadaada amni ee gudaha, inta OpenAI awood u leedahay inay ku wacdo hawlgallada sirgelinta iyo furfuridda sirta KMS-kaaga. Markaad wacdo bar-dhammaadka diiwaangelinta furaha ee OpenAI ee hoos lagu sharraxay, waxaan xaqiijin doonaa dejintaada.

Kadib markaad dhammeystirto tallaabooyinka kore

ChatGPT Enterprise

Fadlan la xiriir xiriirkaaga OpenAI oo la wadaag kuwan soo socda:

"role_arn": "arn:aws:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>"
- Role ARN-ka uu OpenAI ka qaadan doono daruurtaada.
"kms_arn": "arn:aws:kms:<REGION>:<YOUR_AWS_ACCOUNT_NUMBER>:key/<UUID>"
- ARN-ka Key Management System ee furaha master-ka ah ee aad maamusho.

Waxaan EKM u hawlgelin doonaa ururka/goobta shaqadaada ChatGPT.

API

Ka diiwaangeli furahaaga dibadda OpenAI

Raac tilmaamaha tixraacan API-ga: Furayaasha Dibadda ee API-ga Maamulka.

Marka hore, ka diiwaangeli furahaaga dibadda heerka ururka OpenAI, taas oo dhalin doonta aqoonsi furaha dibadda ah.
Tallaabadan, waxaan xaqiijin doonaa in gelintaadu sax tahay iyo inaan si aqoonsi leh ugu xiri karno KMS-kaaga.
Tani weli EKM kuma dari doonto mashruucaaga OpenAI.

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \

"https://api.openai.com/v1/organization/external_keys" \
-d '{
  "type": "aws",
  "name": "Qaabeynta AWS EKM",
  "role_arn": "arn:aws:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>",
  "kms_arn": "arn:aws:kms:<REGION>:<YOUR_AWS_ACCOUNT_NUMBER>:key/<UUID>",
  "external_id": <aqoonsiga ururkaaga ama aqoonsiga mashruuca>
}'

Kadib, samee mashruuc OpenAI oo la xiriira furaha dibadda. Intaas ka dib, EKM waxaa laga hawlgeliyaa mashruucaaga. Jirka jawaabta ee wicitaankan API-ga ayaa ku siin doona aqoonsiga mashruuca (proj_xxx).

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/projects" \
-d '{
   "name": "Mashruuc Tusaale ah",

   "external_key_id": "extkey_xxxx"
}'

Tilmaamaha Isdhexgalka OpenAI / AWS EKM