This is My Architecture Raiffeisen Bank International:
Automated Integration of On-Premises Key Management with AWS KMS
Welcome to This is My Architecture.
I'm Aarthi, and joining me today is Constantin
from Raiffeisen Bank International.
Constantin, welcome to the show.
Thanks for having me.
So, Constantin, tell us what you do at RBI.
RBI is a banking group. It's one of the biggest banking group
in the central Eastern Europe,
and we provide financial services.
Great. So what are we here to talk about today?
Well, obviously, since we are a bank,
basically compliance and data security,
it's a very important topic to us.
And that's why we have built a solution that allows us
to keep the key management on-premise,
and to have the control of our own encryption.
Great. Let's jump into the architecture.
Lovely. So basically, we have two elements.
First element is the onboarding element,
which is creating a virtual wrapper, a virtual tenant.
And the second one, it's the key operation lifecycle.
Great. Why don't we talk about the onboarding element first?
Lovely. So basically what happens is that the security DevOp teams,
they push a file, it's called "mappings.son", into the git.
What is the purpose of the mapping file there?
The mapping file is actually
to tell to the virtual tenant what are the accounts,
AWS accounts that comprise the virtual tenant.
Okay, so what happens after that?
After that, then this file gets uploaded
as a kind of artifact into S3.
There is a Git action.
What happens at the Git level,
and the uploading in S3 will then trigger a step function.
This step function will have a couple of parts.
The first part, it's going to go
and create an IAM role in the particular account.
And this IAM role will allow Thales to assume the role
and to do operations with the key.
The second part would be to create
the virtual tenant itself at this level,
where later the DevOps teams will then generate the key.
And then the third part, once this flow is completely done,
then it will notify back the security DevOps teams
that that particular team or product team is onboarded into Thales.
Great. So now, based on this Lambda function and this IAM role, your Thales,
which is your on-premises key management service,
can now communicate directly with KMS?
That is correct.
Okay, now that we have the onboarding sorted,
how do your users generate keys on-premises,
and then use it with the AWS services?
Right. So what happens is that the DevOps teams,
which are from a product team,
they would then generate a key on Thales.
It's a symmetric 256 bit encryption.
And basically, this would be the CMK,
the master key from a customer managed key in KMS.
Later, then this gets imported over here
as a kind of virtual wrapper where we have two keys inside:
we have the data key and the... master key.
And altogether, they form the so called
data encryption key.
With this data encryption key,
then later, KMS will be able to encrypt
either S3 or EBS or any other service.
So your users are now able to use the data encryption key
that you generated using KMS with S3 and EBS?
That is correct.
Great. You also mentioned, right,
this is a highly regulated industry,
and there could be chances where you have to revoke keys or rotate keys.
How does that process happen?
Right. So this virtual wrapper, what we created,
the so called tenant basically
will be here all the time.
It's a persistent tenant. It will not get erased.
And if we have a data leakage issue,
then what these DevOps teams will do, with an API call
they can delete this master key,
which will then get replicated into the KMS CMK - customer manage key -
which will then remove the secret from that roper key.
And basically by doing that,
we will revoke the access to the secure encrypted files.
Yeah. So your users now don't get
or given you've revoked the key,
there's no more access into your S3 or EBS?
That is correct.
Constant, thank you for sharing this architecture with us,
where you're able to manage
an on-premises key management system
in conjunction with our AWS services.
-You're welcome. -And thank you for watching
This is My Architecture.
Thank you for Watching