awslabs / awslabs/aws-sdk-rust

[request]: AWS KMS client with Nitro Enclaves

Open
#74 8 comments 11 reactions 0 assignees View on GitHub
feature-request high-level-library p2
Dominant language
Rust
Stars
3.3k
Forks
290
Avg merge
1d 12h
Merged PRs (30d)
3

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue, please leave a comment

**Tell us about your request**
What do you want us to build?

Support for AWS KMS client with Nitro Enclaves.
Currently, this is possibly in the AWS Nitro Enclaves C SDK (`aws_nitro_enclaves_kms_client_new`): https://github.com/aws/aws-nitro-enclaves-sdk-c/blob/main/include/aws/nitro_enclaves/kms.h

It'd be good to have a plain Rust version in the AWS Rust SDK.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.

Trying to call AWS KMS API with additional attestation payload produced in AWS Nitro Enclaves.
Right now, the AWS KMS API requests need to be send via `vsock`, because Nitro Enclaves don't allow other forms of I/O.
Building the AWS NE C SDK is rather complex: https://github.com/aws/aws-nitro-enclaves-sdk-c#dependencies
(in comparison to plain Rust projects)

**Are you currently working around this issue?**
How are you currently solving this problem?

Using the C SDK: https://github.com/aws/aws-nitro-enclaves-sdk-c
and this wrapper crate: https://crates.io/crates/aws-ne-sys

**Additional context**
Anything else we should know?
Original issue:
https://github.com/rusoto/rusoto/issues/1858

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

Start with the AWS Nitro Enclaves C SDK entry point `aws_nitro_enclaves_kms_client_new` and its `include/aws/nitro_enclaves/kms.h`, then compare that API with the Rust SDK. Review the linked Rusoto issue and the existing C SDK and `aws-ne-sys` workaround. Done means the Rust SDK supports AWS KMS requests with Nitro Enclaves attestation payloads over vsock.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, rust
Domain
cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.