Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deployment changes for MVA lambda function. #2339

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Deployment changes for MVA lambda function. #2339

wants to merge 2 commits into from

Commits on Sep 18, 2023

  1. Add ALS repository to KIA deployment script. 

    Differential Revision: D49209824

fbshipit-source-id: a64b2eda2df723b205a652860b93496df586c052
    @facebook-github-bot
    Ajinkya Ghonge authored and facebook-github-bot committed Sep 18, 2023
    Configuration menu
    Copy the full SHA
    9b09a06 View commit details
    Browse the repository at this point in the history

  2. Deployment changes for MVA lambda function. 

    Summary:
# Context
As part of KIA - ALS integration. I added logic required for PCR measurement validation to KIA lambda function. As part of this integration, the Lambda function needs to temporarily assume a different IAM role to query the Meta AWS deployed QLDB, validate the measurements and then assume it's original IAM role. While the KIA-ALS integration worked fine, the function was not able to assume it's original role post that. Based on further investigation I see hopping back and forth between IAM roles is not supported right now in AWS Lambda function. In order to solve this issue, I am moving the measurement validation logic to a new lambda that will be invoked from KIA.
Thus, KIA will now invoke this new lambda with the PCRs and QLDB parameters. The new Measurement Validation Agent, will assume the role provided, validate the measurements and return back Success/Failure status back to KIA. Based on the Successful measurement validation then, KIA will proceed with the encryption and on Faillure will terminate the process with a Failed status.

# Changes in the stack
1. Add a new QLDB repo handler : This handler will create the ALS QLDB repository.
2. Add a Measurement validation handler : This handler will hold logic to validate the measurements.
3. Add Measurement validation Runner : Entry point of the lambda function, this will validate the input and call the handlers.
4. Add Deployment changes for the new lambda : Changes need to deploy the new lambda as part of CB AWS infra.
5. Invoke Lambda from KIA :  Add changes required to invoke the MVA lambda from KIA.
6.  Add deployment changes for KIA : As part of this, we will need to pass the MVA lambda function name to KIA, add changes to deployment script for that.
7. Remove Measurement validation code from KIA : Now that the measurement validation logic is moved to a new lambda function, remove it from KIA.
8. Changes to undeploy MVA lambda : Add changes to undeploy MVA lambda when CB is uninstalled.
9. Add changes to CB API to pass QLDB parameters to KIA.
10. Add changes to Coordinator to pass QLDB parameters to CB.

# Changes in this diff
Add Deployment changes for the new lambda : Changes need to deploy the new lambda as part of CB AWS infra.

Differential Revision: D49374679

fbshipit-source-id: 75f4b1af783351f9d316b5d470dcd921bf5f7d3e
    @facebook-github-bot
    Ajinkya Ghonge authored and facebook-github-bot committed Sep 18, 2023
    Configuration menu
    Copy the full SHA
    fb55a4b View commit details
    Browse the repository at this point in the history