BYOK Integration Guide for Amazon Web Services

​

Prerequisites

• Active Kore.ai subscription (platform.kore.ai) with BYOK enabled.
• AWS account with administrative access to IAM and KMS.
• Permissions to create IAM roles and policies.
• Permissions to create and manage KMS keys.

​

Information Exchange

​

Integration Process

1. Create IAM Policy: Define KMS permissions (encrypt, decrypt, generate keys, describe key).
2. Create IAM Role: Establish a trust relationship with Kore.ai and attach the IAM policy.
3. Create KMS Key: Set up a Customer Managed Key for encryption operations.
4. Update KMS Key Policy: Grant the IAM role explicit access to use the KMS key.
5. Verify Configuration: Confirm all components are correctly configured.
6. Share Information: Provide your Role ARN and CMK ARN to Kore.ai support.

​

Step 1: Create IAM Policy

1. Go to AWS Console → IAM → Policies.
2. Click Create policy.
3. Select the JSON tab and paste this policy:
       { "Version": "2012-10-17",
           "Statement": [
           {  
           "Sid": "BYOKKMSPermissions",
           "Effect": "Allow",
           "Action": [
               "kms:Encrypt",
               "kms:Decrypt",
               "kms:GenerateDataKey*",
               "kms:DescribeKey"
                   ],
               "Resource": "arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID"
                   }
               ]
       }
   
   
4. Click Next.
5. Name the policy (e.g., BYOK_KMS_Policy).
6. Add an appropriate description, for example: “Policy granting KMS permissions for BYOK integration with AI for Service Kore.ai Platform”.
7. Click Create policy.

​

Step 2: Create IAM Role

1. Go to AWS Console → IAM → Roles.
2. Click Create role.
3. Select AWS Account as the trusted entity type.
4. Select This account.
5. Click Next.
6. Select the BYOK_KMS_Policy from Step 1.
7. Click Next.
8. Name the role (e.g., BYOK_Role).
9. Add an appropriate description, for example: “Role for BYOK integration with AI for Service Kore.ai Platform.”
10. Click Create role.

​

Update Trust Policy

1. Go to the BYOK_Role you just created.
2. Click the Trust relationships tab.
3. Click Edit trust policy.
4. Replace the policy with the following:
   { "Version": "2012-10-17",
   "Statement": [
   {
   "Effect": "Allow",
       "Principal": {
       "AWS":"arn:aws:iam::358587034707:role/SegBots-Servers-Role"
       },
       "Action": "sts:AssumeRole",
       "Condition": {
       "StringEquals": {
           "sts:ExternalId": "<EXTERNAL-ID>"
       }
       }
   }
   ]
   }
   
   
5. Click Update policy.

​

Step 3: Create KMS Key

1. Go to AWS Console → KMS → Customer managed keys.
2. Click Create key.
3. Select Symmetric as the key type.
4. Select Encrypt and decrypt as the key usage.
5. Click Next.
6. Enter key details:
   1. An Alias (e.g., byok-kore-ai-key).
   2. An appropriate Description, for example: “Customer managed key for BYOK integration with AI for Service Kore.ai Platform”.
7. Click Next.
8. Under Key administrators, add your administrator users or roles as those who should manage this key.
9. Click Next.
10. Add the BYOK_Role as a key user.
11. Click Next.
12. Review the key configuration and click Finish.

​

Step 4: Update KMS Key Policy

1. Go to your KMS key.
2. Click the Key policy tab.
3. Click Edit.
4. Add the customer role statement to the existing Statement array (don’t remove other statements).
   {
   "Sid": "Allow use of the key",
   "Effect": "Allow",
   "Principal": {
       "AWS": "arn:aws:iam::ACCOUNT_ID:role/BYOK_Role"
   },
   "Action": [
       "kms:Encrypt",
       "kms:Decrypt",
       "kms:GenerateDataKey*",
       "kms:DescribeKey"
   ],
   "Resource": "*"
   }
   
   Replace ACCOUNT_ID with your AWS account ID.
5. Save the policy.

​

Step 5: Verify Configuration

​

Step 6: Share Information with Kore.ai

• CMK ARN: arn:aws:kms:<region>:<your-account-id>:key/<key-id>
• Role ARN: arn:aws:iam::<your-account-id>:role/BYOK_Role

​

Configure BYOK Encryption in AI for Service

​

Configuration Steps

1. In the Admin Console, go to Enterprise Key.
2. Click Create Key under the Bring Your Own Key section.\
3. Enter AWS Details:
   • Cloud Provider: Select Amazon Web Services (AWS).
   • Assume Role External ID: Auto-populated.
   • Provider ARN: Enter your CMK ARN.
   • Role ARN: Enter your Role ARN.
4. Set Enforcement Date: Choose when encryption will begin. This is the date your CMK starts encrypting data.
   You can modify the CMK and retest until the enforcement date. After this date, you can only rotate the key or update which apps are encrypted.
5. Test Configuration: Click Test Configuration to validate the connection. The system will test the connection to your KMS, authentication, and encryption and decryption operations. Verify all tests pass before continuing.
6. Select Apps: Click Next to view all applications in your workspace.
   • All apps are selected by default.
   • Deselect any apps you want to keep on the default Kore.ai encryption.
7. Complete Setup: Click Proceed to complete the process. Your CMK is added to the enterprise keys list, and encryption begins on the enforcement date.

​

Validation (Optional)

​

Option 1: View Analytics

​

Option 2: Test Application Authorization

• Execute BasicAuthValidationDialog.
• When the app displays the authorization link, click the link and enter the credentials (admin/password).