You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/learning-paths/servers-and-cloud-computing/cca-veraison-aws/aws-account-prep.md
+11-10Lines changed: 11 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,20 +6,21 @@ weight: 3
6
6
layout: learningpathall
7
7
---
8
8
9
-
## Prepare Your AWS Account
10
-
For this learning path, you will need an active AWS account. If you do not have an AWS account, please refer to the [AWS documentation](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html).
9
+
## Prepare your AWS account
10
+
You’ll need an active AWS account for this Learning Path. If you don't have one yet, refer to the [AWS documentation](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html).
11
11
12
-
This learning path assumes that you have administrator level privileges for your AWS account.
12
+
{{% notice Note %}}
13
+
This Learning Path assumes that you have administrator-level privileges for your AWS account. {{% /notice %}}
13
14
14
-
## Install the AWS Command-Line Tools
15
-
For this section, you will need the AWS Command-Line (CLI) tools. Please refer to the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html)for the steps needed to install the latest version of the AWS CLI.
15
+
## Install AWS command-line tools
16
+
You’ll need the AWS Command-Line Interface (CLI) installed for this section. Follow the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) to install the latest version.
16
17
17
-
## Set Up Authentication
18
-
You will need to configure your local environment to authenticate with the AWS cloud in order to build the Veraison deployment.
18
+
## Set up authentication
19
+
You'll need to set up your local environment to authenticate with AWS before deploying Veraison.
19
20
20
-
The recommended way to do this is using Single Sign-On (SSO). The steps to do this are documented in Veraison's documentation [here](https://github.com/veraison/services/tree/main/deployments/aws#aws-account).
21
+
The recommended method is Single Sign-On (SSO). Follow the steps in Veraison's documentation [here](https://github.com/veraison/services/tree/main/deployments/aws#aws-account).
21
22
22
-
It is important to ensure that authentication is configured correctly. The best way to do this is to run a simple command-line operation such as the following:
23
+
To confirm authentication is configured correctly, run a simple command, such as:
23
24
24
25
```bash
25
26
aws ec2 describe-availability-zones
@@ -66,4 +67,4 @@ You should see output similar to the following (depending on which AWS region yo
66
67
]
67
68
}
68
69
```
69
-
If this operation fails, please do not attempt to proceed with the next steps of this learning path. Refer to [AWS documentation](https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-authentication.html)for help with troubleshooting this step.
70
+
If this operation fails, pause here and troubleshoot using the [AWS documentation](https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-authentication.html)before continuing.
Copy file name to clipboardExpand all lines: content/learning-paths/servers-and-cloud-computing/cca-veraison-aws/deployment.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ layout: learningpathall
9
9
## Create the Veraison Deployment
10
10
Now that your AWS account, internet domain and certificate are prepared, you are ready to deploy the Veraison services into AWS.
11
11
12
-
This process is highly automated, but it takes some time, because a number of resources need to be created in AWS. Be prepared for this step to take from 30 to 60 minutes, although there won't be too much for you to do during this time. You will just run a command to kick off the process.
12
+
This process is highly automated, but will take between 30 to 60 minutes, as several resources need to be created in AWS.
13
13
14
14
The deployment process is documented in [Veraison's GitHub repository](https://github.com/veraison/services/blob/main/deployments/aws/README.md).
15
15
@@ -25,7 +25,7 @@ make bootstrap
25
25
```
26
26
Once your build environment is bootstrapped, you will use the [Quickstart](https://github.com/veraison/services/tree/main/deployments/aws#quickstart) procedure to provide some AWS configuration and create the deployment.
27
27
28
-
You need to provide your AWS account-specific configuration that specifies the IDs of the VPC and subnets that will be used for the deployment as well as the CIDR that will be granted access to the deployment. In this deployment you will use `misc/arm.cfg` file for example. Make sure you update `VERAISON_AWS_REGION` to the same region where you created your AWS Certificate for your new domain.`VERAISON_AWS_DNS_NAME`will need to match the domain name you chose.
28
+
You'll provide AWS-specific settings, including the IDs for your VPC and subnets, and the CIDR block allowed access to the deployment. In this deployment, you will use `misc/arm.cfg` file for example. Make sure you update `VERAISON_AWS_REGION` to the same region where you created your AWS certificate for your new domain.`VERAISON_AWS_DNS_NAME`needs to match the domain name you chose.
29
29
30
30
Once the account-specific config file is created, define `AWS_ACCOUNT_CFG` environment variable to point to it and then create the deployment.
31
31
@@ -35,7 +35,7 @@ export AWS_ACCOUNT_CFG=misc/arm.cfg # replace with path to your config
35
35
make deploy
36
36
```
37
37
38
-
You do not need to use the end-to-end flow as described in the document. Later in this learning path, you will perform some additional steps to prepare and use the Veraison services.
38
+
You do not need to use the end-to-end flow as described in the document. Later in this Learning Path, you will perform some additional steps to prepare and use the Veraison services.
39
39
40
40
The rest of the document provides additional information about how to manage the deployment, but you don't need this now.
41
41
@@ -45,15 +45,15 @@ In the command shell where you ran the steps above, run the following command:
45
45
```bash
46
46
veraison status
47
47
```
48
-
This command will output a status report for the deployment. If successful, it will include information about:-
48
+
This command outputs a status report for the deployment. If successful, it includes information about:
49
49
50
50
- The Amazon Machine Images (AMIs) that have been used for the servers.
51
51
- The status of the VPC stack, support stack and services stack. All of these should read as `created`.
52
52
- Information about RDS, ElastiCache and EC2 resources in the deployment.
53
53
- The version of the Veraison software that is running.
54
54
- The public part of the key that is used to sign attestation results (known as the EAR Verification Key).
55
-
- A list of media types that Veraison will accept as attestation evidence.
56
-
- A list of media types that Veraison will accept as endorsements.
55
+
- A list of media types that Veraison accepts as attestation evidence.
56
+
- A list of media types that Veraison accepts as endorsements.
57
57
58
58
Use the following command to test the REST API endpoint of the verification service. Remember to substitute `example-veraison.com` with the domain name that you used in the initial step, but you will need to keep the `services` prefix as shown.
59
59
@@ -69,6 +69,6 @@ Use the following command to test the REST API endpoint of the endorsement provi
Copy file name to clipboardExpand all lines: content/learning-paths/servers-and-cloud-computing/cca-veraison-aws/domain-and-cert.md
+31-14Lines changed: 31 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,51 +7,68 @@ layout: learningpathall
7
7
---
8
8
9
9
## Create Your Domain in Route53
10
-
Veraison provides cloud services for attestation. These services are published on the internet and are accessible via HTTPS using RESTful APIs. Like all cloud services, they require a suitable internet domain that allows the consumers of those services to locate them. Domains are named using string labels separated by dots (full stops). You will be familiar with domain names such as `www.amazon.com` - they allow public internet resources to be located conveniently and routed using shared internet infrastructure such as DNS.
10
+
Veraison provides cloud services for attestation. These services are published on the internet and are accessible via HTTPS using RESTful APIs. Like all cloud services, they need a domain so users can easily find and access them. Domains are named using string labels separated by dots. You will be familiar with domain names such as `www.amazon.com` - they allow public internet resources to be located conveniently and routed using shared internet infrastructure such as DNS.
11
+
### What is Route53?
11
12
12
-
[Route53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html) is an AWS service that allows you to register and manage domains. In order to create your Veraison deployment in AWS, you will first need to choose a domain name and register it with Route53.
13
+
[Route53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html) is an AWS service that allows you to register and manage domains. In order to create your Veraison deployment in AWS, you first need to choose a domain name and register it with Route53.
13
14
14
-
Your domain name _must_ be unique and specific to your Veraison deployment. Remember that this domain name will be used to create public internet services, so it cannot clash with any other domains that exist on the public internet. In this learning path, we will use `example-veraison.com` as an illustrative example of a domain name. However, _do not_ use this name for your own deployment. Choose your own name, and use it in place of the example as you progress through the learning path.
15
+
### Choosing your domain name
15
16
16
-
The easiest way to create your domain is using the Route53 dashboard in the AWS Management Console. Using your web browser and AWS account credentials, sign into the console and search for the Route53 service. This will take you to the Route53 dashboard. Locate the domain registration option, which will look something like the image below. Remember to use your own domain name where highlighted, not the `example-veraison.com` domain.
17
+
Your domain name must be unique and specific to your Veraison deployment. Remember that this domain name is for creating public internet services, so it cannot clash with any other domains that exist on the public internet.
18
+
19
+
In this Learning Path, you will use `example-veraison.com` as an illustrative example of a domain name. However, do not use this name for your own deployment. Choose your own name, and use it in place of the example as you progress through the Learning Path.
20
+
21
+
### Registering your Domain with Route53
22
+
23
+
The easiest way to create your domain is using the Route53 dashboard in the AWS Management Console:
24
+
25
+
* Using your web browser and AWS account credentials, sign into the console and search for the Route53 service. This takes you to the Route53 dashboard.
26
+
* Locate the domain registration option, which looks something like the image below. Remember to use your own domain name where highlighted, not the `example-veraison.com` domain.
17
27
18
28
**Note:** If you have an existing domain and you wish to transfer it into Route53, instead of creating a new domain, you can use this option as well as shown below. Otherwise, the instructions here assume that you are creating a new domain.
19
29
20
30
21
31
22
-
Route53 will check the domain name for you to ensure that it doesn't clash with others on the internet. Provided that there isn't a clash, Route53 will give you the option of registering your chosen domain name, or some alternatives. For example, it might suggest you could use `example-veraison.net` or `example-veraison.org`.
32
+
Route53 checks your domain name to make sure it’s unique on the internet. Provided that there isn't a clash, Route53 gives you the option of registering your chosen domain name, or some alternatives. For example, it might suggest you could use `example-veraison.net` or `example-veraison.org`.
23
33
24
-
Route53 will charge an annual fee for the domain registration, and the size of this fee can differ depending on your name choice. Choose the name that you would like to use, and proceed to complete the registration process using the on-screen instructions in your browser.
34
+
Route53 charges an annual fee for domain registration, which varies depending on your chosen name. Choose the name that you would like to use, and proceed to complete the registration process using the on-screen instructions in your browser.
25
35
26
36
## Request Your Domain Certificate
27
-
Veraison publishes secure cloud services that can be reached on the internet using HTTPs. This means that you will need a certificate for your registered domain. A certificate will allow consumers of your Veraison services to trust those services and connect with them securely.
28
37
29
-
The [AWS Certificate Manager (ACM)](https://aws.amazon.com/certificate-manager/) can be used to issue a certificate for your domain. Navigate to this service within the AWS Management Console in your web browser.
38
+
### What is a Domain Certificate?
39
+
Veraison publishes secure cloud services that can be reached on the internet using HTTPs. You'll need a certificate for your domain to help users trust and securely connect to your Veraison services.
30
40
31
-
Select "Request Certificate" from the menu on the left as shown.
41
+
### Requesting a Certificate with AWS Certificate Manager
42
+
You can use the [AWS Certificate Manager (ACM)](https://aws.amazon.com/certificate-manager/) to issue a certificate for your domain:
43
+
44
+
* Navigate to this service within the AWS Management Console in your web browser.
45
+
46
+
* Select **Request Certificate** from the menu on the left as shown.
32
47
33
48
34
49
35
-
On the first page of the certificate wizard, select the option to request a **public certificate** as shown below and click **Next**.
50
+
On the first page of the certificate wizard, select **public certificate**, then click **Next**.
36
51
37
52
38
53
39
-
The next page of the wizard will be used to set other properties of the certificate, starting with the domain name. The primary domain name of the certificate must precisely match the domain name that you registered with Route53 in the previous step. However, the Veraison deployment will also create a number of named services nested within that primary domain. In order for the certificate to adequately cover all of those named services, you need to give the certificate an additional name, which uses an asterisk (*) wildcard as shown below. Remember, once again, substitute your chosen domain name to use in place of `example-veraison.com`.
54
+
The next page of the wizard is for setting other properties of the certificate, starting with the domain name. The primary domain name of the certificate must precisely match the domain name that you registered with Route53 in the previous step. However, the Veraison deployment also creates a number of named services nested within that primary domain. In order for the certificate to adequately cover all of those named services, you need to give the certificate an additional name, which uses an asterisk (*) wildcard as shown below. Remember, once again, substitute your chosen domain name to use in place of `example-veraison.com`.
40
55
41
56
Use the **Add another name to this certificate** button to create the secondary name with the wildcard.
42
57
43
58
44
59
45
-
For the validation method, you should use **DNS validation**, which will be the recommended default. You can also use the default **RSA 2048** for the certificate key algorithm as shown below.
60
+
For the validation method, you should use **DNS validation**, which is the recommended default. You can also use the default **RSA 2048** for the certificate key algorithm as shown below.
46
61
47
62
48
63
49
64
Now click **Request** to request the certificate from the Certificate Manager.
50
65
51
-
Before AWS can issue the certificate, it will need to check that you own the domain. Since you have registered the domain in Route53 in the previous step, this will be straightforward.
66
+
### Validating Your Domain Ownership
67
+
68
+
Before AWS can issue the certificate, it checks that you own the domain. Since you registered the domain in Route53 earlier, this is straightforward.
52
69
53
70
Use the ACM dashboard to view the certificate. You will see that it has a status of "Pending Validation". You will also see the two associated domains: `example-veraison.com` and `*.example-veraison.com`, or whatever your chosen domain name is.
54
71
55
-
Click the button that says **Create records in Route 53**. This will allow AWS to prove that you own the domain, at which point it will issue the certificate, and the status will change from "Pending Validation" to "Issued". Be aware that this process can take up to about half an hour.
72
+
Click **Create records in Route 53**to confirm domain ownership. AWS then issues the certificate, and its status changes from **Pending Validation** to **Issued**. Be aware that this process can take up to about half an hour.
56
73
57
74
Once your domain and certificate are prepared, you are ready to create your Veraison deployment.
By default, the endorsement tool assumes that your Veraison services are deployed locally on your machine. This is not the case here, because your Veraison services have been deployed into AWS instead. Therefore, you will need to provide some configuration to the tool, in order to point it at the correct API endpoints with the required authentication.
20
+
By default, the endorsement tool assumes that your Veraison services are deployed locally on your machine. This is not the case here, because your Veraison services have been deployed into AWS instead. You'll need to configure the tool to point it at the correct API endpoints with the required authentication.
21
21
22
22
In the command shell where you created the AWS deployment of Veraison, run the following command:
23
23
@@ -69,7 +69,7 @@ Now run the following command to provision the endorsements:
69
69
```bash
70
70
make endorse
71
71
```
72
-
This command will run the Docker container and send the CCA endorsements to Veraison. You should see output similar to the following:
72
+
This command runs the Docker container and sends the CCA endorsements to your AWS-hosted Veraison deployment. You should see output similar to the following:
73
73
74
74
```output
75
75
docker run --network=host "cca-demo/endorser"
@@ -88,7 +88,7 @@ Next, return to the command shell where you created the Veraison AWS deployment,
88
88
cd$HOME/services/deployments/aws
89
89
veraison stores
90
90
```
91
-
This command will query Veraison's database stores. If the CCA endorsements were provisioned successfully, the output should look something like the example below. (You don't need to be concerned with understanding all of the detail here.)
91
+
This command will query Veraison's database stores. If the CCA endorsements were provisioned successfully, the output should look something like the example below. (You don't need to understand all of the detail here.)
0 commit comments