// Module included in the following assemblies:
//
// * observability/monitoring/enabling-monitoring-for-user-defined-projects.adoc

:_mod-docs-content-type: PROCEDURE
[id="aws-encryption-key_{context}"]
= Create an AWS KMS encryption key

[role="_abstract"]
Using your AWS account and the `aws` CLI tool, you can create an AWS KMS encryption key to encrypt your resources.

.Procedure

. Set the AWS region where you installed your VPC by running the following command:
+
[NOTE]
====
You should use the same region where you installed your VPC.
====
+
[source,terminal]
----
$ AWS_REGION=<aws_region>
----

. Create a custom AWS customer-managed KMS key by running the following command:
+
[source,terminal]
----
$ KMS_ARN=$(aws kms create-key --region $AWS_REGION --description 'Custom ROSA Encryption Key' --tags TagKey=red-hat,TagValue=true --query KeyMetadata.Arn --output text)
----
+
This command saves the Amazon Resource Name (ARN) output of this custom key for further steps.
+
[NOTE]
====
Customers must provide the `--tags TagKey=red-hat,TagValue=true` argument that is required for a customer KMS key.
====

. Verify the KMS key has been created by running the following command:
+
[source,terminal]
----
$ echo $KMS_ARN
----

. Set your AWS account ID to an environment variable by running the following command:
+
[source,terminal]
----
$ AWS_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
----

. Create your AWS key policy by running the following command.
+
[NOTE]
====
If you use the default prefix, you need to modify the following code sample where you see `{PREFIX}-` to `ManagedOpenShift-`.
====
+
[source,terminal]
----
cat << EOF > rosa-key-policy.json
{
    "Version": "2012-10-17",
    "Id": "key-rosa-policy-1",
    "Statement": [
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${AWS_ACCOUNT}:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow ROSA use of the key",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Support-Role",
                    "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Installer-Role",
                    "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Worker-Role",
                    "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-openshift-cluster-csi-drivers-ebs-cloud-credentials",
                    "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-kube-system-kms-provider"
                ]
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow attachment of persistent resources",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Support-Role",
                    "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Installer-Role",
                    "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Worker-Role",
                    "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-openshift-cluster-csi-drivers-ebs-cloud-credentials"
                ]
            },
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        }
    ]
}
EOF
----

. Confirm the details of the policy file created by running the following command:
+
[source,terminal]
----
$ cat rosa-key-policy.json
----

. Apply the newly generated key policy to the custom KMS key by running the following command:
+
[source,terminal]
----
aws kms put-key-policy --key-id $KMS_ARN --policy file://rosa-key-policy.json --policy-name default
----
+
You can now create your cluster using this AWS KMS encryption key.