セキュリティ管理
はじめに
キー ローテーションは追加のセキュリティ機能です。元のキーが侵害された場合に攻撃を受ける可能性の軽減に役立ちます。キーを定期的にローテーションできるため、キー侵害攻撃をさらに減らせます。キー ローテーションは既定では有効化されていません。有効にすることをお勧めします。
As an Atlassian Data Center administrator, you can manage the lifecycle of AES keys generated by Jira Data Center through a set of REST APIs. These APIs allow you to manage keys either manually or programmatically.
These APIs don't apply to the AES keys that encrypt user directory passwords.
AES キー管理 API
この API は、AES キーのローテーション、非アクティブなキーの取得、非アクティブなキーの削除のためのエンドポイントを提供します。以下に、URL、受け入れ HTTP メソッド、可能な応答コード、それらの意味など、各エンドポイントの詳細な説明を示します。
Endpoints
1. Rotate AES Key
This endpoint is used to rotate the AES encryption key. Existing secrets will be re-encrypted with the new key.
Method:
POSTURL:
https://<HOSTNAME>:<PORT>/rest/secrets/1.0/keys/rotateQuery parameters: None
Request body: None
Response Codes
200 OK: Returned if the AES key was rotated successfully.
401 Unauthorized: Returned if the user is not authorized to perform the operation.
406 Not Acceptable: Returned if the rotation cannot occur due to invalid conditions.
500 Internal Server Error: Returned if an unexpected error occurs when performing the operation.
Response body
{
"message": "<detailed_message>",
"status": "<rotation_status>"
}2. Get Inactive AES Keys
Once key rotation is completed, the old AES key becomes inactive. This endpoint retrieves a list of inactive AES key(s).
Method:
GETURL:
https://<HOSTNAME>:<PORT>/rest/secrets/1.0/keys/inactiveQuery parameters: None
Request body: None
Response Codes
200 OK: Returned if the inactive AES key(s) were retrieved successfully.
401 Unauthorized: Returned if the user is not authorized to perform the operation.
500 Internal Server Error: Returned if an unexpected error occurs when performing the operation.
Response body
{
"inactiveKeys": [
"<inactive_key_name>"
]
}3. Delete Inactive AES Keys
Once key rotation is completed, the old AES key becomes inactive. This endpoint deletes all inactive AES key(s).
Method:
DELETEURL:
https://<HOSTNAME>:<PORT>/rest/secrets/1.0/keys/inactiveQuery parameters: None
Request body: None
Response Codes
200 OK: Returned if the inactive AES key(s) were deleted successfully.
401 Unauthorized: Returned if the user is not authorized to perform the operation.
500 Internal Server Error: Returned if an unexpected error occurs when performing the operation.
Response body
{
"deletedKeys": [
"<deleted_key_name>"
]
}監査ログ
Key rotation and deletion events can all be found in the Jira audit logs.
トラブルシューティングとヒント
認証
All endpoints require the user to be authorized. Ensure that you include the appropriate authorization headers with your requests.
エラー処理
500 応答 (内部サーバー エラー) が発生した場合は、アプリのログを確認して、不具合の原因を調査します。
401 (無許可) という応答を受け取ったら、自分の資格情報と権限を確認してください。
使用上の注意
Ensure that you replace <HOSTNAME> and <PORT> with the actual host and port of your DC instance.