AWS enclaves documentation change
Summary
Expanded --private-key parameter to support KMS key ARNs, added signing example, and clarified documentation for enclave image signing
Security assessment
The changes enhance documentation about secure enclave image signing using KMS integration and attestation measurements (PCR8). While security-related, there is no evidence this addresses a specific vulnerability.
Diff
diff --git a/enclaves/latest/user/cmd-nitro-build-enclave.md b/enclaves/latest/user/cmd-nitro-build-enclave.md index 3abd6211e..4f6eb1bcd 100644 --- a/enclaves/latest/user/cmd-nitro-build-enclave.md +++ b/enclaves/latest/user/cmd-nitro-build-enclave.md @@ -28 +28 @@ For example, when using Nitro Enclaves with AWS Key Management Service (AWS KMS) - [--private-key key.pem] + [--private-key key] @@ -65 +65,3 @@ Required: Yes -The private key to use to sign the enclave image file. Only ECDSA keys are supported for code for signing. If you specify `--private-key` then you must also specify `--signing-certificate`. If you specify these parameter, the command creates a signed enclave image file. The command output will include an additional PCR, `PCR8`, which can be used in condition keys for KMS key policies. For more information, see [Where to get an enclave's measurements](./set-up-attestation.html#where). +The private key to use to sign the enclave image file. This can be a KMS key ARN, or a path to a local private key file. For more information, see [Key ARN](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN). + +Only ECDSA keys are supported for code for signing. If you specify `--private-key` then you must also specify `--signing-certificate`. If you specify this parameter, the command creates a signed enclave image file. The command output will include an additional PCR, `PCR8`, which can be used in condition keys for KMS key policies. For more information, see [Where to get an enclave's measurements](./set-up-attestation.html#where). @@ -74 +76 @@ Required: No -The signing key to use to sign the enclave image file. If you specify `--signing-certificate` then you must also specify `--private-key`. If you specify these parameter, the command creates a signed enclave image file. The command output will include and additional PCR, `PCR8`, which can be used in condition keys for KMS key policies. For more information, see [Where to get an enclave's measurements](./set-up-attestation.html#where). +The signing key to use to sign the enclave image file. If you specify `--signing-certificate` then you must also specify `--private-key`. If you specify these parameters, the command creates a signed enclave image file. The command output will include and additional PCR, `PCR8`, which can be used in condition keys for KMS key policies. For more information, see [Where to get an enclave's measurements](./set-up-attestation.html#where). @@ -114,0 +117,20 @@ The following example converts a Docker image with a URI of `sample:latest` to a +The following example converts a Docker image with a URI of `sample:latest` to an enclave image file named `sample.eif`, and signs it using a KMS key. + +**Command** + + + nitro-cli build-enclave --docker-uri sample:latest --output-file sample.eif --private-key arn:aws:kms:eu-west-1:123456789321:key/abcdef12-3456-789a-bcde-111122223333 --signing-certificate certificate.pem + +**Output** + + + Enclave Image successfully created.{ + "Measurements": { + "HashAlgorithm": "Sha384 { ... }", + "PCR0": "EXAMPLE59044e337c00068c2c033546641e37aa466b853ca486dd149f641f15071961db2a0827beccea9cade3EXAMPLE", + "PCR1": "EXAMPLE7783d0c23167299fbe5a69622490a9bdf82e94a0a1a48b0e7c56130c0c1e6555de7c0aa3d7901fbc58EXAMPLE", + "PCR2": "EXAMPLE4b51589e8374b7f695b4649d1f1e9b528b05ab75a49f9a0a4a1ec36be81280caab0486f660b9207ac0EXAMPLE", + "PCR8": "EXAMPLEdcca7f74398ae152d6ee245d8ac2cd430fb63644b46bf47b7d36b53b91c7597edda2d5df772cc81b72EXAMPLE" + } + } +