Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Feature]: SKR Policy Location #19984

Closed
thaiolivia opened this issue Oct 29, 2022 · 2 comments · Fixed by #20005
Closed

[Feature]: SKR Policy Location #19984

thaiolivia opened this issue Oct 29, 2022 · 2 comments · Fixed by #20005
Assignees
@BethanyZhou
Labels
feature-request This issue requires a new behavior in the product in order be resolved. KeyVault Tracking We will track status and follow internally
Milestone
December 2022 (20...

Comments

@thaiolivia
Copy link

Description of the new feature

Today default CVM SKR Policy is stored as a blob in a test subscription - https://cvmprivatepreviewsa.blob.core.windows.net/cvmpublicpreviewcontainer/skr-policy.json

This is risky as anyone in the subscription can modify the file and cause CVM CMK scenario to fail. Currently, PowerShell reads from this storage account which we would like to avoid.

We have decided to shift the key release policy to GitHub which you can find here: https://raw.githubusercontent.com/Azure/confidential-computing-cvm/main/cvm_deployment/key/skr-policy.json

We would like for skr-policy reference to point to this GitHub as well for PowerShell to store a local backup copy.

Proposed implementation details (optional)

Ideal implementation date is before the end of the quarter.
@thaiolivia thaiolivia added feature-request This issue requires a new behavior in the product in order be resolved. needs-triage This is a new issue that needs to be triaged to the appropriate team. labels Oct 29, 2022
@ghost ghost removed the needs-triage This is a new issue that needs to be triaged to the appropriate team. label Oct 29, 2022
@dingmeng-xue dingmeng-xue added KeyVault Tracking We will track status and follow internally labels Oct 31, 2022
@thaiolivia
Copy link
Author

Update: This is more urgent for PowerShell since public access of storage account blobs are listed as SEV1 concern

@BethanyZhou BethanyZhou linked a pull request Nov 2, 2022 that will close this issue
[KeyVault] Shifted the location of key CVM release policy to GitHub #20005
Merged
1 task
@BethanyZhou
Copy link
Contributor

BethanyZhou commented Nov 3, 2022 •
edited

please expect this feature supported in next release (Dec 6th).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@BethanyZhou BethanyZhou

Labels
feature-request This issue requires a new behavior in the product in order be resolved. KeyVault Tracking We will track status and follow internally
Projects
None yet
Milestone
December 2022 (2022-12-06)
Development

Successfully merging a pull request may close this issue.

[KeyVault] Shifted the location of key CVM release policy to GitHub BethanyZhou/azure-powershell
3 participants
@BethanyZhou @thaiolivia @dingmeng-xue