IBM Cloud: Hyper Protect Crypto Services(HPCS) + Unified Key Orchestrator(UKO)を使って、AWSのKMSにBYOKしてみた

# 1. はじめに

Hyper Protect Crypto Services(HPCS) は Unified Key Orchestrator(UKO)を利用することで、HPCSで生成した鍵を他社クラウドにBYOKするための機能を提供している。

https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-use-cases
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/e1da95cc-b87f-5d6f-ff74-cc497903330f.png)



HPCSの初期化作業については、以下の記事がよくまとまっているが、（私自身がやったことがなかったので）念の為その記事をなぞる形でコマンド結果を載せている。
[Hyper Protect Crypto Servicesを使ってみた　その１（初期化）](https://qiita.com/y_tama/items/5d2104dcc37b9463bb88)
[Hyper Protect Crypto Servicesを使ってみた　その２（ROKS連携）](https://qiita.com/y_tama/items/b6f2e4f023574b35f3ec)

HPCSの初期化作業について興味がない人は、3章をスキップして4章から参照してもらうと良い。本稿ではAWSへのBYOKを試してみた。以下の手順は、
https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started
における、Step1, Step2, Step 3 (Unified Key Orchestrator Plan only)を順に追う形で試している。


# 2. 注文

https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services

東京リージョンおよび、プランとして`Unified Key Orchestrator`を選択する。東京リージョンでは、`Failover region`は選択できないため、最小構成の以下で注文する。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/5d6eb3a8-0862-70ed-6057-7fe448585da6.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/c84411bf-253d-3be1-2d27-3bce25475951.png)

2-30分程でプロビジョニングが完了した。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/2bb3abc4-4928-d225-e01d-d5a979192a48.png)


# 3. HPCSの初期化

## 3-1. 暗号化ユニットを表示

```txt:ログイン
$ ibmcloud plugin install tke
$ ibmcloud plugin update tke
$ mkdir tke-files
$ export CLOUDTKEFILES=/Users/syasuda/tke-files
$ ibmcloud target -r jp-tok -g Default
```
```txt:Crypto Unitは2つ存在し、SELECTEDはfalse状態
$ ibmcloud tke cryptounits
Verifying the OA certificate chain for serial number 93AACH95...
Successfully verified the OA certificate chain for 93AACH95.

Verifying the OA certificate chain for serial number 93AAB5FR...
Successfully verified the OA certificate chain for 93AAB5FR.


API endpoint:     https://cloud.ibm.com
Region:           jp-tok
User:             xxxxxxx@xx.xxx.xxx
Account:          xxx (xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx)
Resource group:   Default

SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   SELECTED   LOCATION
1                 false      [jp-tok].[AZ2-tok2-qz1-sr2-rk071-a01].[06].[04]
2                 false      [jp-tok].[AZ3-tok3-qz1-sr2-rk048-a01].[05].[03]

Note: all crypto units in a service instance must be configured the same.
Use 'ibmcloud tke cryptounit-compare' to check how crypto units are configured.

```

## 3-2. 操作対象とする暗号化ユニットを選択

```txt:Crypto Unit 1, 2を選択
$ ibmcloud tke cryptounit-add

API endpoint:     https://cloud.ibm.com
Region:           jp-tok
User:             xxxxxxx@xx.xxx.xxx
Account:          xxx (xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx)
Resource group:   Default

SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   SELECTED   LOCATION
1                 false      [jp-tok].[AZ2-tok2-qz1-sr2-rk071-a01].[06].[04]
2                 false      [jp-tok].[AZ3-tok3-qz1-sr2-rk048-a01].[05].[03]

Note: all crypto units in a service instance must be configured the same.
Use 'ibmcloud tke cryptounit-compare' to check how crypto units are configured.

Enter a list of CRYPTO UNIT NUM to add, separated by spaces:
> 1 2
OK

API endpoint:     https://cloud.ibm.com
Region:           jp-tok
User:             xxxxxxx@xx.xxx.xxx
Account:          xxx (xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx)
Resource group:   Default

SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   SELECTED   LOCATION
1                 true       [jp-tok].[AZ2-tok2-qz1-sr2-rk071-a01].[06].[04]
2                 true       [jp-tok].[AZ3-tok3-qz1-sr2-rk048-a01].[05].[03]

Note: all crypto units in a service instance must be configured the same.
Use 'ibmcloud tke cryptounit-compare' to check how crypto units are configured.
```
```txt:SELECTEDはtrue状態
$ ibmcloud tke cryptounits

API endpoint:     https://cloud.ibm.com
Region:           jp-tok
User:             xxxxxxx@xx.xxx.xxx
Account:          xxx (xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx)
Resource group:   Default

SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   SELECTED   LOCATION
1                 true       [jp-tok].[AZ2-tok2-qz1-sr2-rk071-a01].[06].[04]
2                 true       [jp-tok].[AZ3-tok3-qz1-sr2-rk048-a01].[05].[03]

Note: all crypto units in a service instance must be configured the same.
Use 'ibmcloud tke cryptounit-compare' to check how crypto units are configured.
```
```txt:Crypt Unitの比較。差異がないことを確認。
$ ibmcloud tke cryptounit-compare

SIGNATURE THRESHOLDS
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   SIGNATURE THRESHOLD   REVOCATION THRESHOLD
1                 0                     0
2                 0                     0

==> Crypto units with a signature threshold of 0 are in IMPRINT MODE. <==


CRYPTO UNIT ADMINISTRATORS
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   ADMIN NAME          SUBJECT KEY IDENTIFIER
1                 No administrators
2                 No administrators


NEW MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
2                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000


CURRENT MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
2                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000


CONTROL POINTS
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   XCP_CPB_ALG_EC_25519   XCP_CPB_BTC   XCP_CPB_ECDSA_OTHER
1                 Set                    Set           Set
2                 Set                    Set           Set

==> All crypto units are configured the same. <==
```

## 3-3. マスターキーのロード
## 3-3-1. signature keyの作成

```txt:signature keyの確認。
$ ibmcloud tke sigkeys
No files containing a signature key were found.

To create a file containing a signature key, use the 'ibmcloud tke sigkey-add' command.
```
```txt:signature keyを作成。
$ ibmcloud tke sigkey-add
Enter an administrator name to be associated with the signature key:
> syasuda
Enter a password to protect the signature key:
>
Re-enter the password to confirm:
>
OK
A signature key was created.
The available signature keys on this workstation are:

KEYNUM   DESCRIPTION   SUBJECT KEY IDENTIFIER
1        syasuda       4f834177b192f433e8adb188445166...

No KEYNUM are selected as current signature keys.
```
```txt:signature keyの確認。
$ ibmcloud tke sigkeys

KEYNUM   DESCRIPTION   SUBJECT KEY IDENTIFIER
1        syasuda       4f834177b192f433e8adb188445166...

No KEYNUM are selected as current signature keys.
```
```txt:signature keyを選択。
$ ibmcloud tke sigkey-sel

KEYNUM   DESCRIPTION   SUBJECT KEY IDENTIFIER
1        syasuda       4f834177b192f433e8adb188445166...

No KEYNUM are selected as current signature keys.

Enter the KEYNUM values to select as current signature keys, separated by spaces:
> 1
Enter the password for KEYNUM 1:
>
OK
KEYNUM 1 has been made the current signature key.
```
```txt:signature keyの確認。
$ ibmcloud tke sigkeys

KEYNUM   DESCRIPTION   SUBJECT KEY IDENTIFIER
1        syasuda       4f834177b192f433e8adb188445166...

KEYNUM 1 is selected as the current signature key.
```

## 3-3-2. 暗号化ユニットにadministratorを追加

```txt:administratorの確認
$ ibmcloud tke cryptounit-admins

No crypto unit administrators for service instance 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
```
```txt:administratorの追加
$ ibmcloud tke cryptounit-admin-add

KEYNUM   DESCRIPTION   SUBJECT KEY IDENTIFIER
1        syasuda       4f834177b192f433e8adb188445166...

KEYNUM 1 is selected as the current signature key.

Enter the KEYNUM of the administrator signature key you wish to load:
> 1
Enter the password for the administrator signature key file:
>
OK
The crypto unit administrator was added to the selected crypto units.
```
```txt:administratorの確認
$ ibmcloud tke cryptounit-admins

SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   ADMIN NAME   SUBJECT KEY IDENTIFIER
1                 syasuda      4f834177b192f433e8adb188445166...
2                 syasuda      4f834177b192f433e8adb188445166...
```

## 3-3-3. 閾値の設定

```txt:「コマンドを実行するのに何人のadministratorが必要か？」を設定する閾値確認
$ ibmcloud tke cryptounit-thrhlds

SIGNATURE THRESHOLDS
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   SIGNATURE THRESHOLD   REVOCATION THRESHOLD
1                 0                     0
2                 0                     0

==> Crypto units with a signature threshold of 0 are in IMPRINT MODE. <==
```
```txt:閾値の設定
$ ibmcloud tke cryptounit-thrhld-set

Enter the new signature threshold value:
> 1

Enter the new revocation signature threshold value:
> 1
Enter the password for the signature key identified by:
syasuda (4f834177b192f433e8adb188445166...)
>
OK
New signature threshold values have been set in the selected crypto units.

SIGNATURE THRESHOLDS
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   SIGNATURE THRESHOLD   REVOCATION THRESHOLD
1                 1                     1
2                 1                     1

==> Crypto units with a signature threshold of 0 are in IMPRINT MODE. <==
```
```txt:「コマンドを実行するのに何人のadministratorが必要か？」を設定する閾値確認
$ ibmcloud tke cryptounit-thrhlds

SIGNATURE THRESHOLDS
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   SIGNATURE THRESHOLD   REVOCATION THRESHOLD
1                 1                     1
2                 1                     1

==> Crypto units with a signature threshold of 0 are in IMPRINT MODE. <==
```

## 3-3-4. マスターキーパーツの作成

```txt:キーパーツの確認
$ ibmcloud tke mks

No files containing an EP11 master key part were found.
```
```txt:1つ目のキーパーツの作成
$ ibmcloud tke mk-add --random
Enter a description for the key part:
> masterkeypart01
Enter a password to protect the key part:
>
Re-enter the password to confirm:
>
OK
A key part was created.
The available EP11 master key parts on this workstation are:

KEYNUM   DESCRIPTION       VERIFICATION PATTERN
1        masterkeypart01   4cf069ff93ee657ef8b946f7ae9d87eb
                           1381b044df21fe55eb3707b98fcfa649
```
```txt:2つ目のキーパーツの作成
$ ibmcloud tke mk-add --random
Enter a description for the key part:
> masterkeypart02
Enter a password to protect the key part:
>
Re-enter the password to confirm:
>
OK
A key part was created.
The available EP11 master key parts on this workstation are:

KEYNUM   DESCRIPTION       VERIFICATION PATTERN
1        masterkeypart01   4cf069ff93ee657ef8b946f7ae9d87eb
                           1381b044df21fe55eb3707b98fcfa649
2        masterkeypart02   44875df8111694a4e377d54d83b0d5fd
                           4230feb0ccee04e1cb8bb82bd4254815
```
```txt:キーパーツの確認
$ ibmcloud tke mks

KEYNUM   DESCRIPTION       VERIFICATION PATTERN
1        masterkeypart01   4cf069ff93ee657ef8b946f7ae9d87eb
                           1381b044df21fe55eb3707b98fcfa649
2        masterkeypart02   44875df8111694a4e377d54d83b0d5fd
                           4230feb0ccee04e1cb8bb82bd4254815
```


## 3-3-5. master keyのアップロード

```txt:Crypto Unitにおけるmaster keyの状態
$ ibmcloud tke cryptounit-mks

NEW MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
2                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000


CURRENT MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
2                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
```
```txt:master keyのアップロード
$ ibmcloud tke cryptounit-mk-load

KEYNUM   DESCRIPTION       VERIFICATION PATTERN
1        masterkeypart01   4cf069ff93ee657ef8b946f7ae9d87eb
                           1381b044df21fe55eb3707b98fcfa649
2        masterkeypart02   44875df8111694a4e377d54d83b0d5fd
                           4230feb0ccee04e1cb8bb82bd4254815

Enter the KEYNUM values of the master key parts you wish to load.
2 or 3 values must be specified, separated by spaces.
> 1 2
Enter the password for the signature key identified by:
syasuda (4f834177b192f433e8adb188445166...)
>
Enter the password for key file 1
>
Enter the password for key file 2
>
OK
The new master key register has been loaded in the selected crypto units.

NEW MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS             VERIFICATION PATTERN
1                 Full Uncommitted   ad4bed6dd9e3c07654762508fd5f969f
                                     0f811f0a27ec8ff3ae031adc6ff92aa4
2                 Full Uncommitted   ad4bed6dd9e3c07654762508fd5f969f
                                     0f811f0a27ec8ff3ae031adc6ff92aa4
```


## 3-3-6. master keyのコミット

```txt:Crypto Unitにおけるmaster keyの状態。NEW MASTER KEYの登録状態は、まだFull Uncommitted
$ ibmcloud tke cryptounit-mks

NEW MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS             VERIFICATION PATTERN
1                 Full Uncommitted   ad4bed6dd9e3c07654762508fd5f969f
                                     0f811f0a27ec8ff3ae031adc6ff92aa4
2                 Full Uncommitted   ad4bed6dd9e3c07654762508fd5f969f
                                     0f811f0a27ec8ff3ae031adc6ff92aa4


CURRENT MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
2                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
```

```txt:Commit
$ ibmcloud tke cryptounit-mk-commit
Enter the password for the signature key identified by:
syasuda (4f834177b192f433e8adb188445166...)
>
OK
The new master key register has been committed in the selected crypto units.

NEW MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS           VERIFICATION PATTERN
1                 Full Committed   ad4bed6dd9e3c07654762508fd5f969f
                                   0f811f0a27ec8ff3ae031adc6ff92aa4
2                 Full Committed   ad4bed6dd9e3c07654762508fd5f969f
                                   0f811f0a27ec8ff3ae031adc6ff92aa4
```
```txt:Crypto Unitにおけるmaster keyの状態。NEW MASTER KEYの登録状態は、Full Committedになった。ただし、CURRENT MASTER KEYはまだEmptyのまま。
$ ibmcloud tke cryptounit-mks

NEW MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS           VERIFICATION PATTERN
1                 Full Committed   ad4bed6dd9e3c07654762508fd5f969f
                                   0f811f0a27ec8ff3ae031adc6ff92aa4
2                 Full Committed   ad4bed6dd9e3c07654762508fd5f969f
                                   0f811f0a27ec8ff3ae031adc6ff92aa4


CURRENT MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
2                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
```

## 3-3-7. master keyのactivate

```txt:master keyのactivate
$ ibmcloud tke cryptounit-mk-setimm
Warning!  Any key storage associated with the targeted service instance must be prepared to accept the new master key value before running this command.  Otherwise, key storage may become unusable.
Do you want to continue?
Answer [y/N]:
> y
Enter the password for the signature key identified by:
syasuda (4f834177b192f433e8adb188445166...)
>
OK
Set immediate completed successfully in the selected crypto units.

NEW MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
2                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000


CURRENT MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Valid    ad4bed6dd9e3c07654762508fd5f969f
                           0f811f0a27ec8ff3ae031adc6ff92aa4
2                 Valid    ad4bed6dd9e3c07654762508fd5f969f
                           0f811f0a27ec8ff3ae031adc6ff92aa4
```
```txt:Crypto Unitにおけるmaster keyの状態。CURRENT MASTER KEYがValidとなった。
$ ibmcloud tke cryptounit-mks

NEW MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000
2                 Empty    00000000000000000000000000000000
                           00000000000000000000000000000000


CURRENT MASTER KEY REGISTER
SERVICE INSTANCE: 2f3b5e36-3ab8-4946-aee6-192d1a71bee3
CRYPTO UNIT NUM   STATUS   VERIFICATION PATTERN
1                 Valid    ad4bed6dd9e3c07654762508fd5f969f
                           0f811f0a27ec8ff3ae031adc6ff92aa4
2                 Valid    ad4bed6dd9e3c07654762508fd5f969f
                           0f811f0a27ec8ff3ae031adc6ff92aa4

```

## 3-4. 最終形態でのUI上の表示
`Master key not activated`の警告がなくなった。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/52d6a273-6957-b2f6-1071-a33ad5e7de7a.png)

# 4. Unified Key Orchestrator(UKO)

## 4-1. IAMで権限を付与する。
- [Enhancing Security(UKO plan): Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-access)

以下は全部の権限を割り当てた際の例。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/329e1a4e-61a1-22ec-b0e2-a6724b116a12.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/e46cddf2-e4c3-75a7-d22f-960532c03eb4.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/214b4494-0f43-cf19-c610-050752bdc0d5.png)


## 4-2. Vaultの作成

Vaultは

- 鍵
- HPCSと同一インスタンス内のKeystore
- AWS/AzureのようなリモートにあるKeystore

の集まりを管理するための器であり、Vault単位でIAMによるアクセス制御が可能である。

https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-vaults&interface=ui
https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaults

- Create Vault ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/3c0983e7-a273-7300-d1c9-19ceea5b8094.png)
- Vaultの名前などを入力 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/131879f3-a45a-2503-e3fa-86ebd6620c78.png)
- 作成完了![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/a6e086a0-2a90-48d4-fa29-1f09fa639361.png)

## 4-3. Keystoreの作成

https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-internal-keystores&interface=ui

- Add keystore ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/9b48f12b-6fd6-55a4-7ae1-739515feab8a.png)
- 先程作成したVaultを選択してNext ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/8da1a2b4-eb1a-9635-fa70-bb14c539335c.png)
- 今回はremote keystoreとしてAWSを利用するため、`AWS keystore`を選択。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/afaf23ed-315c-0c83-42a5-3c594ef22df2.png)
- `keystore`の名称や、AWSのリージョン（東京リージョンは`ap_northeast`)、Access key情報などを入力。Test Connectionによって接続の可否を確認。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/eaf2c49c-4937-4619-5c8e-2e6530f59855.png)
- 接続テストがうまくいったらNext ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/4ae3fcc1-8c88-da46-bc84-f9d96dfc3836.png)
- Add keystore ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/1be121cb-cc18-14ec-8428-7e672a89cff3.png)
- 作成完了 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/74b5741e-b93f-c9ac-0ca9-d98765a038e6.png)

## 4-4 AWSに配布するmanaged keyの作成

https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keys&interface=ui

- Create key ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/b74a3ada-46a4-8ebb-ddc5-293be834b5b2.png)
- 先程作成したVaultを選択 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/dfb116ed-da17-2352-88dd-8c6019ad2949.png)
- `AWS Key Management Service`を選択 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/94d50a57-3461-91ba-08fe-7a654bfa0ac0.png)
- 鍵の名称などを選択。Stateは即時に有効するか、後から有効にするかを選択できる。今回は即時に有効にする`Active`を選択。その他expiration dateやタグ情報を入力。本稿執筆時点でのUKOではこのexpiration dateになったからといって勝手にstateが変わる訳ではない。 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/34584dcd-be4e-7be3-a72e-1e3126cdc373.png)
- 鍵の配置先（配布先）であるkeystoreを選択。 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/6d9292c6-93d6-4cbb-90a8-6e9ef90a5460.png)
- 最終確認。問題なければ、Create Key。 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/ddb5eec2-ed1f-a569-6a01-d25c7017c43c.png)
- 鍵が作成された。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/0b6bf3c7-c2de-f178-2af7-c17f375e8df5.png)

## 4-5 配布された鍵と関連イベントの確認

以下は、AWS上でのKMSの状態。確かに鍵が配布されている。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/816a6adb-a022-1d80-55fe-460b63786f9f.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/f37aed5d-e327-ec95-deae-debbdfa60622.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/3d56227e-17ae-14a4-9536-fd70e07fa0bf.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/b92a98be-5446-7315-a02f-eeed071b3518.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/0c49cfec-2bfd-9bd2-8456-7aebb6c3b865.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/defb3cce-dd03-d2b2-0e6b-1c452bf837f8.png)

また一連のイベントは、IBM Cloud側ではActivity Tracker with LogDNAにて確認が可能である。
https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-at-events&interface=ui#uko-at-events-analyze-failed
- Activity Tracker with LogDNA ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/459dcd42-de09-862d-a2fa-08c5ac5bed7c.png)

AWS側では、AWS CloudTrailを使って一連のAPI呼び出し処理の内容が確認可能である。
- イベント一覧
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/be3b58ce-80cf-4454-f7a3-f9a4bc94daeb.png)
- イベント詳細。例えば、TLS1.3を使ってAPIが呼び出されていることがわかる。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/e66e13dd-fcd2-7ff0-a1d7-bc5899529bb0.png)



# 5. UKOを使った鍵の状態変更に伴うテスト

## 5-1 Deactivate
- HPCS上でdeactivateする。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/806c9672-f1de-8c07-4849-1c4c73d85964.png)
- deactivateの確認画面 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/6352da67-177d-6c45-d833-6441c053c4cc.png)
- deactivateになった（見えない場合は、フィルタリングされている可能性があるので注意）![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/9417f78b-04d2-d001-3b98-2d3bdd5e6a6a.png)
- AWS上では`Pending Import`になった。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/9114834c-25b5-d7f4-338c-f5c4019cc204.png)

## 5-2 Activate
- 再度activateする。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/f4a6db65-391d-be0f-57f1-729f426fea33.png)
- 確認画面 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/a3c042cb-3731-e3dd-e052-3d108300d3dd.png)
- AWS上で再度`Enabled`になった![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/bb07644e-68dc-be58-8d19-96000460cf5c.png)

## 5-3 Destroy
- deactivateした後に、destroyする（activate状態から直接destroyはできない）。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/e57da303-2923-6115-134e-897bb98c7f75.png)
- 確認。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/844712d2-159c-164a-b031-0a718de12b2b.png)
- Destroyed状態になった。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/a02916a6-b459-dab9-3be1-c9160b7bfd60.png)
- AWS上では、`Pending Deletion`になった。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/4ebd7133-1107-6ea5-36fe-45273eb3b882.png)

## 5-4 Remove from vault
- Remove From Vault ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/1f7189d1-5311-09e4-4f06-df093247f107.png)
- 確認。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/d70a8098-6c53-0538-a62c-91c93156f2de.png)
- Vaultから消えた。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/60662231-2462-c6d3-fe61-d92e2290baa9.png)
- AWSでは`Pending Deletion`のままだった。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/47a7cee2-339c-19c3-4eed-a3db292d4484.png)

## 5-5. 複数の鍵の配布とPre-activeの鍵の状態

- 複数の鍵を作成する。test3のみはPre-activeの状態で鍵を作成する。 ![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/3fe46a42-e7b9-cb9f-c0fc-d4f2ce1d7297.png)
- AWS上での確認。Pre-activeの鍵は作成されていない。![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2746922/121494b0-6dd7-b3be-72b4-4ac64f3b7d65.png)