1
beyondcorp = {
2
    "访问代理": "验证用户和设备身份",
3
    "设备清单服务": "跟踪受管设备",
4
    "用户/组清单": "管理用户权限",
5
    "访问策略引擎": "基于上下文的访问决策",
6
    "策略信息源": "提供威胁情报"
7
}
8

9
# 访问决策因素
10
access_decision = {
11
    "用户身份": "已验证的用户和组",
12
    "设备状态": "受管设备、合规状态",
13
    "上下文": "IP 地址、时间、风险评分",
14
    "资源敏感度": "数据分类级别"
15
}

1
encryption_types = {
2
    "SSE-S3": {
3
        "加密类型": "AES-256",
4
        "密钥管理": "AWS S3 托管",
5
        "适用场景": "标准文件存储"
6
    },
7
    "SSE-KMS": {
8
        "加密类型": "AES-256",
9
        "密钥管理": "AWS KMS (CMK)",
10
        "适用场景": "需要密钥轮换、审计"
11
    },
12
    "SSE-C": {
13
        "加密类型": "客户提供密钥",
14
        "密钥管理": "客户完全控制",
15
        "适用场景": "合规要求严格"
16
    },
17
    "CSE-KMS": {
18
        "加密类型": "AES-256",
19
        "密钥管理": "KMS (客户端加密)",
20
        "适用场景": "端到端加密"
21
    }
22
}

1
# TLS 配置最佳实践
2
ssl_config:
3
  min_version: "TLS 1.2"
4
  preferred_ciphers:
5
    - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
6
    - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
7
  disabled_ciphers:
8
    - "TLS_RSA_WITH_AES_128_CBC_SHA"
9
    - "TLS_RSA_WITH_3DES_EDE_CBC_SHA"

1
{
2
  "Version": "2012-10-17",
3
  "Id": "key-policy",
4
  "Statement": [
5
    {
6
      "Sid": "Enable IAM User Permissions",
7
      "Effect": "Allow",
8
      "Principal": {
9
        "AWS": "arn:aws:iam::123456789:root"
10
      },
11
      "Action": "kms:*",
12
      "Resource": "*"
13
    },
14
    {
15
      "Sid": "Allow use of key",
16
      "Effect": "Allow",
17
      "Principal": {
18
        "AWS": "arn:aws:iam::123456789:role/DataRole"
19
      },
20
      "Action": [
21
        "kms:Encrypt",
22
        "kms:Decrypt",
23
        "kms:ReEncrypt*",
24
        "kms:GenerateDataKey*"
25
      ],
26
      "Resource": "*"
27
    }
28
  ]
29
}

1
# AWS 自动轮换：每 365 天（CMK）
2
# 客户管理密钥可手动轮换
3

4
import boto3
5

6
# 手动创建密钥版本
7
client = boto3.client('kms')
8
response = client.rotate_key_on_demand(
9
    KeyId='alias/my-key'
10
)

1
key_hierarchy = """
2
主密钥 (Master Key / CMK)
3
    │
4
    ├── 数据密钥 (Data Key)
5
    │       ├── 用于加密数据文件
6
    │       └── 用主密钥加密后存储
7
    │
8
    └── 密钥加密密钥 (KEK)
9
            └── 用于加密数据密钥
10
"""

1
data_classification = {
2
    "公开": {
3
        "标识": "PUBLIC",
4
        "加密": "可选",
5
        "访问控制": "无限制",
6
        "示例": ["营销材料", "公开文档"]
7
    },
8
    "内部": {
9
        "标识": "INTERNAL",
10
        "加密": "传输加密",
11
        "访问控制": "员工认证",
12
        "示例": ["内部流程", "非敏感数据"]
13
    },
14
    "敏感": {
15
        "标识": "SENSITIVE",
16
        "加密": "静态加密",
17
        "访问控制": "需要授权",
18
        "示例": ["PII", "合同"]
19
    },
20
    "机密": {
21
        "标识": "CONFIDENTIAL",
22
        "加密": "强加密 + MFA",
23
        "访问控制": "特定角色",
24
        "示例": ["商业秘密", "密钥"]
25
    },
26
    "绝密": {
27
        "标识": "TOP SECRET",
28
        "加密": "硬件安全模块",
29
        "访问控制": "高管审批",
30
        "示例": ["核心算法", "战略规划"]
31
    }
32
}

1
data_handling = {
2
    "收集": {
3
        "原则": "最小化收集",
4
        "检查": ["是否必要", "是否经过同意", "是否告知用途"]
5
    },
6
    "存储": {
7
        "原则": "安全存储",
8
        "检查": ["加密", "访问控制", "保留期限"]
9
    },
10
    "使用": {
11
        "原则": "限定用途",
12
        "检查": ["用途是否正当", "是否脱敏"]
13
    },
14
    "共享": {
15
        "原则": "受控共享",
16
        "检查": ["是否有协议", "是否脱敏", "是否审计"]
17
    },
18
    "销毁": {
19
        "原则": "安全销毁",
20
        "检查": ["是否彻底", "是否有证明"]
21
    }
22
}

1
# AWS Secrets Manager
2
apiVersion: v1
3
kind: Secret
4
metadata:
5
  name: db-credentials
6
type: Opaque
7
stringData:
8
  username: admin
9
  password: secret123
10

11
# 自动轮换
12
rotation:
13
  enabled: true
14
  days: 30

1
# 存储密钥
2
vault kv put secret/database username=admin password=secret123
3

4
# 动态凭证
5
vault read database/creds/my-role
6

7
# 加密传输
8
vault operator init -key-shares=5 -key-threshold=3