AWS
Looma oggola in la fuliyo: sts:AssumeRole
Isticmaalaha: arn:aws:sts::xxxxx:assumed-role/EnterpriseKeyManagement/OpenAI-EKM-Service looma oggola inuu fuliyo: sts:AssumeRole resource-ka: arn:aws:iam::xxxxx:role/xxxxxxHubi principal-ka iyo ExternalId-ka ku jira trust policy-gaaga
Hubi inaad raacday qaybtan dukumentiyada, oo ay ku jiraan LABADABA aqoonsiga principal-ka OpenAI iyo dejinta sts:ExternalId
Haddii aad hore u gelisay sts:ExternalId, hubi inuu yahay isla ID-ga ururka OpenAI ee aad EKM ku dabaqayso, ee uusan ahayn org kale sida org shakhsi ah.
Hubi xiriirka trust policy-ga iyo role ARN
Hubi in trust policy-gaaga si sax ah loogu kaydiyay role ARN-ka aad bixisay
Sidoo kale hubi inaad bixisay role ARN sax ah. Haddii ARN-kaaga si khaldan loo qoray oo uusan jirin, waxaan heli doonnaa khalad la mid ah kan dhacaya marka role-ku jiro balse uu diido oggolaanshaha.
Looma oggola in la fuliyo: kms:Encrypt resource-ka
Isticmaalaha: xxxxx looma oggola inuu fuliyo: kms:Encrypt resource-kaHubi in IAM policy-gaagu uu kms:Encrypt iyo kms:Decrypt u oggolaado role-ka OpenAI.
Haddii aad sidoo kale ku dartay key policy, hubi inuu isna kms:Encrypt iyo kms:Decrypt u oggolaado role-ka OpenAI.
GCP
Waa lagu guuldarraystay in la helo token-ka GCP STS ee audience-ka
Waa lagu guuldarraystay in la helo token-ka GCP STS ee audience-ka //iam.googleapis.com/projects/xxxxxxxxx/locations/global/workloadIdentityPools/xxxxxxx/providers/xxxxxxxxxx: {'error': 'invalid_request', 'error_description': 'Qiime aan sax ahayn oo loogu talagalay \"audience\". Qiimahani waa inuu noqdaa magaca resource-ka oo buuxa ee Identity Provider. Ka eeg https://cloud.google.com/iam/docs/reference/sts/rest/v1/TopLevel/token liiska qaababka suurtagalka ah.GCP wuxuu filayaa audience leh qaabkan
iam.googleapis.com/projects/xxxxxxxxx/locations/global/workloadIdentityPools/xxxxxxx/providers/xxxxxxxxxx
Hubi inaad bixisay parameters-ka saxda ah marka aad key-gaaga ka diiwaangelinayso OpenAI adigoo adeegsanaya Furayaasha Dibadda ee Management API
Hubi in workload_identity_project_number uu yahay lambarka mashruucaaga GCP ee 12-god ah
Hubi in workload_identity_pool_id uu sax yahay
Hubi in workload_identity_provider_id uu sax yahay
Audience-ka ku jira ID token lama mid aha audience-ka la filayay
Waa lagu guuldarraystay in la helo token-ka GCP STS ee audience-ka //iam.googleapis.com/projects/xxxxxx/locations/global/workloadIdentityPools/xxxxxxx/providers/xxxxxxxx: {'error': 'invalid_grant', 'error_description': 'Audience-ka ku jira ID Token [xxxxx] lama mid aha audience-ka la filayay xxxxxxx.'}Hubi in field-ka audience ee aad bixiso marka aad config-gaaga ka diiwaangelinayso OpenAI (Furayaasha Dibadda ee Management API ) uu ku jiro mid ka mid ah Allowed Audiences-kaaga ee workload identity provider-kaaga. Waxaan ku talinaynaa inaad isticmaasho ID-ga ururkaaga OpenAI.
Azure
Codsiga macmiilka waxaa ka maqan service principal
Codsiga macmiilka xxxxx waxaa ka maqan service principal gudaha tenant-ka xxxxx. Ka eeg tilmaamaha halkan: https://go.microsoft.com/fwlink/?linkid=2225119Hubi inaad si sax ah u raacday abuurista service principal-ka sida lagu qeexay Tilmaamaha Isku-darka OpenAI / Azure EKM.
Cidda wacaysa looma oggola inay tallaabo ka fuliso resource-ka
Cidda wacaysa looma oggola inay tallaabo ka fuliso resource-ka. Haddii role assignments, deny assignments ama role definitions dhawaan la beddelay, fadlan sug waqtiga faafitaanka.Khaladkan isku midka ahi wuxuu ku soo bixi karaa sababo dhowr ah
Waxaad bixisay magac key ama vault URI khaldan, ama mid aan jirin
Ma aadan abuurin role leh data actions-kan IYO role-kaas uma aadan qoondeyn service principal-ka OpenAI
Microsoft.KeyVault/vaults/keys/encrypt/action
Microsoft.KeyVault/vaults/keys/decrypt/action
Magaca key-gu lama jaanqaadayo pattern-ka
"'key_name' aan sax ahayn: string-ku lama jaanqaadayo pattern-ka. Waxaa la filayay string la jaanqaada pattern-ka '^org-[0-9a-zA-Z-]*--[0-9a-zA-Z-]*$'."Fadlan magaca key-ga Key Vault ku hor-dar ID-ga ururkaaga OpenAI.
Tani waa habka ugu wanaagsan ee ay amnigu ku talinayaan si looga hortago in key-gaaga key vault uu diiwaangeliyo isticmaale kale. Waxaan xaqiijinnaa in org id-gu is waafaqsan yahay marka key-ga la diiwaangelinayo iyo codsi kasta oo loo diro key vault-kaaga.