Nitro-cli build-enclave - When using a KMS key as the private-key, How is the signing-certificate generated?

When using nitro-cli build-enclave with the --private-key parameter set to a KMS key ARN, you need to generate the signing certificate separately before building the enclave. Here's the process: Step-by-Step Process

1. Create an Asymmetric KMS Key: First, create an asymmetric KMS key suitable for signing (e.g., RSA_2048, RSA_3072, or RSA_4096 with SIGN_VERIFY key usage).

2. Generate a Certificate Signing Request (CSR) :You need to generate a CSR that includes the public key from your KMS asymmetric key. This can be done by:

   --Exporting the public key from KMS using GetPublicKey --Creating a CSR using the exported public key

3. Sign the CSR with a Certificate Authority: Submit the CSR to a Certificate Authority (CA) to get it signed. You can use:

   --AWS Certificate Manager Private CA to issue the certificate

   --Your own private CA infrastructure

4. Use the Certificate with nitro-cli build-enclave: Once you have the signed certificate, you provide both:

   --private-key with the KMS key ARN --signing-certificate with the path to your certificate file

The nitro-cli will use the KMS key for signing operations during the enclave build process, while the certificate provides the public key verification chain.

Hey,

Hope you're keeping well.

When you use a KMS asymmetric CMK ARN with nitro-cli build-enclave --private-key, the enclave image is signed by making a Sign API call to KMS rather than accessing the private key directly. To generate the signing certificate, you first call GetPublicKey on the KMS key to retrieve the public half, then create a CSR from that public key. The CSR is submitted to a CA such as AWS Certificate Manager Private CA or your own CA to issue the signing certificate, which you then provide to nitro-cli along with the KMS key ARN. This works only with asymmetric CMKs that support SIGN_VERIFY and a supported RSA key spec.

Thanks and regards,
Taz

Hey,

Hope you're keeping well.

When you use a KMS asymmetric CMK with nitro-cli build-enclave, KMS never exposes the private key, so you can’t generate the signing certificate the same way as with a local key. Instead, you export the public key using the aws kms get-public-key command, build a CSR from that public key, and then have the CSR signed by a CA such as ACM Private CA or your own CA. The resulting certificate is what you pass to nitro-cli along with the KMS key ARN, and KMS will handle the signing operations internally during enclave image signing. This works only with asymmetric CMKs that support the SIGN_VERIFY usage.

Thanks and regards,
Taz