跳至內容
使用 AWS re:Post 即表示您同意 AWS re:Post 使用條款
AWS re:Postre:Post
關於 re:Post

Can Cloudtrail support KMS code signing transparency logs (e.g. by logging signatures)?

-1

I would like to use AWS KMS for code signing. Additionally, I would like to publish transparency logs as an assurance that the signing key has not signed unknown code. However CloudTrail logs don't include useful information about the response, such as the original message digest or the resulting signature. The log entry only seems to really record that a sign operation was requested against a key ID, at a specific time.

Is there any way to get more detailed information about key use from KMS?

requestParameters	
  keyId	"4ae12714-..."
  messageType	"DIGEST"
  signingAlgorithm	"RSASSA_PKCS1_V1_5_SHA_512"
responseElements	null
requestID	"6f955fef-..."
eventID	"40787b80-..."
主題
管理與治理安全性、身分識別與合規
標籤
AWS 鑰匙管理服務AWS CloudTrail
語言
English

已提問 2 個月前檢視次數 73 次

1 個回答
1
已接受的答案

CloudTrail does intentionally not log the message part of the invocation, nor the signature part of the response, and this is non-configurable.

If you want to build that, the easiest way is probably to write your own wrapper to kms.sign() and handle the logging there (so from your own application code), or, if it fits the requirements, the purpose-built AWS Signer which maintains its own signing audit trail.

AWS

已回答 2 個月前

專家

已審閱 2 個月前

  • Gordon
    2 個月前

    CloudTrail does intentionally not log the message part of the invocation, nor the signature part of the response, and this is non-configurable.

    Disappointing, since that functionality is really essential to transparency (e.g. https://en.wikipedia.org/wiki/Certificate_Transparency)

    If you want to build that, the easiest way is probably to write your own wrapper to kms.sign()

    Logging use at the client really is not a substitute. If a key were misused, the adversarial misuse could simply log a plausible entry.

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋，同時有助於提問者的專業成長。

相關內容