awslabs / awslabs/aws-sdk-rust
[request]: AWS KMS client with Nitro Enclaves
- Dominant language
- Rust
- Stars
- 3.3k
- Forks
- 290
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 3
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue, please leave a comment
**Tell us about your request**
What do you want us to build?
Support for AWS KMS client with Nitro Enclaves.
Currently, this is possibly in the AWS Nitro Enclaves C SDK (`aws_nitro_enclaves_kms_client_new`): https://github.com/aws/aws-nitro-enclaves-sdk-c/blob/main/include/aws/nitro_enclaves/kms.h
It'd be good to have a plain Rust version in the AWS Rust SDK.
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.
Trying to call AWS KMS API with additional attestation payload produced in AWS Nitro Enclaves.
Right now, the AWS KMS API requests need to be send via `vsock`, because Nitro Enclaves don't allow other forms of I/O.
Building the AWS NE C SDK is rather complex: https://github.com/aws/aws-nitro-enclaves-sdk-c#dependencies
(in comparison to plain Rust projects)
**Are you currently working around this issue?**
How are you currently solving this problem?
Using the C SDK: https://github.com/aws/aws-nitro-enclaves-sdk-c
and this wrapper crate: https://crates.io/crates/aws-ne-sys
**Additional context**
Anything else we should know?
Original issue:
https://github.com/rusoto/rusoto/issues/1858
**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)
Contributor guide
Research direction
Start with the AWS Nitro Enclaves C SDK entry point `aws_nitro_enclaves_kms_client_new` and its `include/aws/nitro_enclaves/kms.h`, then compare that API with the Rust SDK. Review the linked Rusoto issue and the existing C SDK and `aws-ne-sys` workaround. Done means the Rust SDK supports AWS KMS requests with Nitro Enclaves attestation payloads over vsock.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, rust
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100