aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Make sure CFN Helper Scripts (cfn-init) are FIPS 140-2 compliant.

Open
#520 2 comments 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

## 1. Title
#### AWS::CloudFormation::Init

## 2. Scope of request
AWS::CloudFormation::Init - Helper scripts FIPS compliance

## 3. Expected behaviour
#### When performing FIPS validation the `cfn-init`, `cfn-signal` tools should pass FIPS validation and not use any non-FIPS compliance algorithms and hashes.

## 4. Suggest specific test cases

1. Start an instance in FIPS compliant mode[1][2]/
2. Bootstrap using `cfn-init` testing common modules.
3. Ensure this works without errors.

## 5. Helpful Links to speed up research and evaluation
#### [1] [How RHEL 8 is designed for FIPS 140-2 requirements](https://www.redhat.com/en/blog/how-rhel-8-designed-fips-140-2-requirements)
#### [2] [Enable FIPS 140-2 Mode on Amazon Linux 2](https://www.arhea.net/posts/2020-04-15-enable-fips-140-2-amazonlinux-2.html)

## 6. Category (required)

1. Compute (EC2, ECS, EKS, Lambda...)

## 7. Any additional context (optional)

When using the `cfn-init` tool with FIPS 140-2 enabled you will get an error similar to:

```
error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

cfnbootstrap/util.py includes a MD5 hash-check which doesn't work when FIPS is enabled, and there is no flag/option to disable the hash-check or use a different validation method that is compatible with FIPS:
```

This error is likely due to using MD5 hash verification in the `cfn-init` tool which is disabled in a FIPS 140-2 enabled instance.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.