スキップしてコンテンツを表示
AWS re:Postを使用することにより、以下に同意したことになります AWS re:Post 利用規約
AWS re:Postre:Post
re:Postに関して

Can Cloudtrail support KMS code signing transparency logs (e.g. by logging signatures)?

-1

I would like to use AWS KMS for code signing. Additionally, I would like to publish transparency logs as an assurance that the signing key has not signed unknown code. However CloudTrail logs don't include useful information about the response, such as the original message digest or the resulting signature. The log entry only seems to really record that a sign operation was requested against a key ID, at a specific time.

Is there any way to get more detailed information about key use from KMS?

requestParameters	
  keyId	"4ae12714-..."
  messageType	"DIGEST"
  signingAlgorithm	"RSASSA_PKCS1_V1_5_SHA_512"
responseElements	null
requestID	"6f955fef-..."
eventID	"40787b80-..."
トピック
管理とガバナンスセキュリティ、アイデンティティ、コンプライアンス
タグ
AWS Key Management ServiceAWS CloudTrail
言語
English

質問済み 2ヶ月前73ビュー

1回答
1
承認された回答

CloudTrail does intentionally not log the message part of the invocation, nor the signature part of the response, and this is non-configurable.

If you want to build that, the easiest way is probably to write your own wrapper to kms.sign() and handle the logging there (so from your own application code), or, if it fits the requirements, the purpose-built AWS Signer which maintains its own signing audit trail.

AWS

回答済み 2ヶ月前

エキスパート

レビュー済み 2ヶ月前

  • Gordon
    2ヶ月前

    CloudTrail does intentionally not log the message part of the invocation, nor the signature part of the response, and this is non-configurable.

    Disappointing, since that functionality is really essential to transparency (e.g. https://en.wikipedia.org/wiki/Certificate_Transparency)

    If you want to build that, the easiest way is probably to write your own wrapper to kms.sign()

    Logging use at the client really is not a substitute. If a key were misused, the adversarial misuse could simply log a plausible entry.

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

関連するコンテンツ