Enforce KMS identity in admission policy

Author: h4x3rotab

consul-postgres-ha/ATTESTATION.md

@@ -9,6 +9,9 @@ Enable it in `cluster-example/terraform.tfvars`:
 enable_attestation_admission = true
 consul_management_token      = "<consul-acl-management-token>"
 dstack_verifier_image        = "dstacktee/dstack-verifier:0.5.9"
+kms                          = "phala"
+# admission_expected_kms_public_key defaults to the public key for the
+# default phala KMS backend. Override it when changing kms.
 ```
 
 Use a versioned verifier tag and pin it by digest for production.
@@ -32,8 +35,9 @@ current dstack guest agents: `quote`, `event_log`, and `vm_config`.
    sends `{identity, binding, nonce, quote, event_log, vm_config}` to
    the broker.
 6. The broker verifies the quote through `dstack-verifier`, checks
-   report-data binding and nonce freshness, then matches identity,
-   peer id, and compose hash against the Terraform policy.
+   report-data binding, nonce freshness, and KMS key-provider
+   identity, then matches identity, peer id, and compose hash against
+   the Terraform policy.
 7. On success the broker mints a scoped Consul ACL token. Worker
    agents receive a node-identity token; service workloads receive
    service-identity tokens plus any declared Consul permissions.
@@ -103,11 +107,25 @@ as:
 - `event_log_verified == true`
 - `report_data` present and equal to the broker-computed digest
 - `app_info.compose_hash` present and policy-allowed
+- `app_info.key_provider_info` present and equal to the policy-pinned
+  KMS provider id
 
 KMS identity should be policy-controlled because it defines the key
-lifecycle. A production policy should pin the long-term KMS public
-key or an equivalent well-known KMS identity that is hard-coded in
-Terraform and checked against verified dstack evidence.
+lifecycle. This example pins the long-term KMS public key in
+Terraform as `admission_expected_kms_public_key` and checks it
+against the verifier-returned `app_info.key_provider_info`. The
+verifier field is a hex-encoded JSON payload:
+
+```json
+{
+  "name": "kms",
+  "id": "<public-key-hex>"
+}
+```
+
+The pinned key must match the `kms` backend used in the Phala launch
+configuration. The Terraform default matches the example's default
+`kms = "phala"` backend; override it when changing KMS backend.
 
 For production profiles, OS image identity should also be checked.
 The expected OS image hash should be both a Terraform launch setting

consul-postgres-ha/PROGRESS.md

@@ -36,9 +36,9 @@ deployment model, trust model, or operational status.
 - Terraform slot API: integrate the newly implemented Phala Cloud
   slot API into the Terraform deployment flow. Tracking note:
   `design/terraform-slot-api.md`.
-- KMS policy: pin the long-term KMS public key or equivalent KMS
-  identity in Terraform and require the verifier-proven KMS evidence
-  to match it.
+- KMS policy: Terraform now carries the selected KMS backend and the
+  expected long-term KMS public key; admission requires the verifier
+  returned key-provider evidence to match it.
 - Production OS policy: when a production profile is enabled, include
   the expected OS image hash in both Phala launch config and admission
   policy.

consul-postgres-ha/admission-broker/main.go

@@ -78,11 +78,17 @@ func main() {
 type Policy struct {
 	Cluster     string     `json:"cluster"`
 	PolicyEpoch int        `json:"policy_epoch"`
+	KMS         *KMSPolicy `json:"kms,omitempty"`
 	Workloads   []Workload `json:"workloads"`
 
 	byIdentity map[string][]Workload
 }
 
+type KMSPolicy struct {
+	Name string `json:"name"`
+	ID   string `json:"id"`
+}
+
 type Workload struct {
 	WorkloadID            string            `json:"workload_id"`
 	Identity              string            `json:"identity"`
@@ -115,6 +121,11 @@ func ParsePolicy(b []byte) (*Policy, error) {
 	if p.PolicyEpoch <= 0 {
 		return nil, errors.New("policy_epoch must be positive")
 	}
+	if p.KMS != nil {
+		if err := normalizeKeyProviderInfo(p.KMS); err != nil {
+			return nil, fmt.Errorf("kms: %w", err)
+		}
+	}
 	if len(p.Workloads) == 0 {
 		return nil, errors.New("workloads must not be empty")
 	}
@@ -185,6 +196,21 @@ func (p *Policy) Match(identity, composeHash, peerID string) (*Workload, error)
 	return nil, fmt.Errorf("identity %q is not allowed for compose_hash %s", identity, normalized)
 }
 
+func (p *Policy) CheckKMS(verified *VerifiedQuote) error {
+	if p.KMS == nil {
+		return nil
+	}
+	if verified.KeyProvider == nil {
+		return errors.New("verifier response missing app_info.key_provider_info")
+	}
+	if verified.KeyProvider.Name != p.KMS.Name || verified.KeyProvider.ID != p.KMS.ID {
+		return fmt.Errorf("kms key provider mismatch: got %s/%s want %s/%s",
+			verified.KeyProvider.Name, shortHex(verified.KeyProvider.ID),
+			p.KMS.Name, shortHex(p.KMS.ID))
+	}
+	return nil
+}
+
 func normalizeComposeHash(h string) (string, error) {
 	h = strings.TrimSpace(strings.TrimPrefix(strings.ToLower(h), "0x"))
 	if len(h) != 64 {
@@ -196,6 +222,33 @@ func normalizeComposeHash(h string) (string, error) {
 	return h, nil
 }
 
+func normalizeKeyProviderInfo(k *KMSPolicy) error {
+	k.Name = strings.ToLower(strings.TrimSpace(k.Name))
+	if k.Name == "" {
+		return errors.New("name is required")
+	}
+	id, err := normalizeHexBytes(k.ID)
+	if err != nil {
+		return fmt.Errorf("id: %w", err)
+	}
+	k.ID = id
+	return nil
+}
+
+func normalizeHexBytes(s string) (string, error) {
+	s = strings.TrimSpace(strings.TrimPrefix(strings.ToLower(s), "0x"))
+	if s == "" {
+		return "", errors.New("must not be empty")
+	}
+	if len(s)%2 != 0 {
+		return "", fmt.Errorf("hex length must be even, got %d", len(s))
+	}
+	if _, err := hex.DecodeString(s); err != nil {
+		return "", fmt.Errorf("must be hex: %w", err)
+	}
+	return s, nil
+}
+
 type Server struct {
 	policy      *Policy
 	nonces      *NonceStore
@@ -292,6 +345,10 @@ func (s *Server) handleAttest(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusForbidden, "REPORT_DATA_MISMATCH", "attestation report_data does not match binding statement and nonce")
 		return
 	}
+	if err := s.policy.CheckKMS(verified); err != nil {
+		writeError(w, http.StatusForbidden, "KMS_POLICY_MISMATCH", err.Error())
+		return
+	}
 
 	workload, err := s.policy.Match(req.Identity, verified.ComposeHash, bindingStatement.PeerID)
 	if err != nil {
@@ -444,6 +501,7 @@ type VerifiedQuote struct {
 	ComposeHash string
 	AppID       string
 	ReportData  string
+	KeyProvider *KMSPolicy
 }
 
 type VerifierClient struct {
@@ -485,6 +543,7 @@ func (c *VerifierClient) Verify(ctx context.Context, req VerifyRequest) (*Verifi
 		AppInfo          struct {
 			AppID       string `json:"app_id"`
 			ComposeHash string `json:"compose_hash"`
+			KeyProvider string `json:"key_provider_info"`
 		} `json:"app_info"`
 		Details struct {
 			QuoteVerified    bool   `json:"quote_verified"`
@@ -493,6 +552,7 @@ func (c *VerifierClient) Verify(ctx context.Context, req VerifyRequest) (*Verifi
 			AppInfo          struct {
 				AppID       string `json:"app_id"`
 				ComposeHash string `json:"compose_hash"`
+				KeyProvider string `json:"key_provider_info"`
 			} `json:"app_info"`
 		} `json:"details"`
 	}
@@ -505,6 +565,7 @@ func (c *VerifierClient) Verify(ctx context.Context, req VerifyRequest) (*Verifi
 	reportData := firstNonEmpty(parsed.ReportData, parsed.Details.ReportData)
 	appID := firstNonEmpty(parsed.AppInfo.AppID, parsed.Details.AppInfo.AppID)
 	composeHashRaw := firstNonEmpty(parsed.AppInfo.ComposeHash, parsed.Details.AppInfo.ComposeHash)
+	keyProviderRaw := firstNonEmpty(parsed.AppInfo.KeyProvider, parsed.Details.AppInfo.KeyProvider)
 
 	valid := parsed.IsValid && quoteVerified && eventLogVerified
 	reason := firstNonEmpty(parsed.Reason, parsed.Error)
@@ -524,15 +585,42 @@ func (c *VerifierClient) Verify(ctx context.Context, req VerifyRequest) (*Verifi
 			return nil, fmt.Errorf("verifier app_info.compose_hash: %w", err)
 		}
 	}
+	var keyProvider *KMSPolicy
+	if keyProviderRaw != "" {
+		keyProvider, err = decodeKeyProviderInfo(keyProviderRaw)
+		if err != nil {
+			return nil, fmt.Errorf("verifier app_info.key_provider_info: %w", err)
+		}
+	}
 	return &VerifiedQuote{
 		Valid:       valid,
 		Reason:      reason,
 		ComposeHash: composeHash,
 		AppID:       appID,
 		ReportData:  strings.TrimPrefix(strings.ToLower(strings.TrimSpace(reportData)), "0x"),
+		KeyProvider: keyProvider,
 	}, nil
 }
 
+func decodeKeyProviderInfo(raw string) (*KMSPolicy, error) {
+	raw, err := normalizeHexBytes(raw)
+	if err != nil {
+		return nil, err
+	}
+	b, err := hex.DecodeString(raw)
+	if err != nil {
+		return nil, err
+	}
+	var k KMSPolicy
+	if err := json.Unmarshal(b, &k); err != nil {
+		return nil, fmt.Errorf("decoded payload is not key-provider JSON: %w", err)
+	}
+	if err := normalizeKeyProviderInfo(&k); err != nil {
+		return nil, err
+	}
+	return &k, nil
+}
+
 type TokenRequest struct {
 	Description       string
 	ConsulService     string
@@ -771,6 +859,13 @@ func shortSHA256(s string, hexChars int) string {
 	return out[:hexChars]
 }
 
+func shortHex(s string) string {
+	if len(s) <= 16 {
+		return s
+	}
+	return s[:16]
+}
+
 func writeJSON(w http.ResponseWriter, status int, v any) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)

consul-postgres-ha/admission-broker/main_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 const testHash = "1434154969cb663afc5a73393b84cc31a1319ab6c65c9766fadd0c86bb59ef37"
+const testKMSKey = "aabbccddeeff00112233445566778899"
 
 func TestPolicyMatchAllowsSharedComposeHashPerIdentity(t *testing.T) {
 	policy := mustPolicy(t, `{
@@ -111,6 +112,41 @@ func TestPolicyMatchesDeclaredPeerID(t *testing.T) {
 	}
 }
 
+func TestPolicyNormalizesKMSKeyProvider(t *testing.T) {
+	policy := mustPolicy(t, `{
+	  "cluster": "demo",
+	  "policy_epoch": 1,
+	  "kms": {"name": "KMS", "id": "0x`+testKMSKey+`"},
+	  "workloads": [{
+	    "workload_id": "demo/worker/0/webdemo",
+	    "identity": "spiffe://demo/webdemo",
+	    "consul_service": "webdemo",
+	    "allowed_compose_hashes": ["`+testHash+`"]
+	  }]
+	}`)
+
+	if policy.KMS == nil {
+		t.Fatal("kms policy was not parsed")
+	}
+	if policy.KMS.Name != "kms" {
+		t.Fatalf("wrong kms name: %s", policy.KMS.Name)
+	}
+	if policy.KMS.ID != testKMSKey {
+		t.Fatalf("wrong kms id: %s", policy.KMS.ID)
+	}
+}
+
+func TestDecodeKeyProviderInfo(t *testing.T) {
+	raw := hex.EncodeToString([]byte(`{"name":"kms","id":"0x` + testKMSKey + `"}`))
+	got, err := decodeKeyProviderInfo(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Name != "kms" || got.ID != testKMSKey {
+		t.Fatalf("wrong key provider: %+v", got)
+	}
+}
+
 func TestReportDataHexBindsStatementAndNonce(t *testing.T) {
 	binding := "abcd"
 	nonce := "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f"
@@ -144,7 +180,11 @@ func TestAttestFlow(t *testing.T) {
 				"quote_verified":     true,
 				"event_log_verified": true,
 				"report_data":        expectedReportData,
-				"app_info":           map[string]string{"compose_hash": testHash, "app_id": "app_abc"},
+				"app_info": map[string]string{
+					"compose_hash":      testHash,
+					"app_id":            "app_abc",
+					"key_provider_info": hex.EncodeToString([]byte(`{"name":"kms","id":"` + testKMSKey + `"}`)),
+				},
 			},
 		})
 	}))
@@ -153,7 +193,7 @@ func TestAttestFlow(t *testing.T) {
 	issuer := &recordingIssuer{token: "secret-token"}
 	now := time.Unix(100, 0).UTC()
 	s := &Server{
-		policy:      mustPolicy(t, `{"cluster":"demo","policy_epoch":7,"workloads":[{"workload_id":"demo/worker/0/webdemo","identity":"spiffe://demo/webdemo","consul_service":"webdemo","allowed_compose_hashes":["`+testHash+`"]}]}`),
+		policy:      mustPolicy(t, `{"cluster":"demo","policy_epoch":7,"kms":{"name":"kms","id":"`+testKMSKey+`"},"workloads":[{"workload_id":"demo/worker/0/webdemo","identity":"spiffe://demo/webdemo","consul_service":"webdemo","allowed_compose_hashes":["`+testHash+`"]}]}`),
 		nonces:      NewNonceStore(time.Minute),
 		verifier:    &VerifierClient{URL: verifier.URL, HTTP: verifier.Client()},
 		issuer:      issuer,
@@ -215,6 +255,76 @@ func TestAttestFlow(t *testing.T) {
 	}
 }
 
+func TestAttestRejectsKMSMismatch(t *testing.T) {
+	var expectedReportData string
+	verifier := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		writeJSON(w, http.StatusOK, map[string]any{
+			"is_valid": true,
+			"details": map[string]any{
+				"quote_verified":     true,
+				"event_log_verified": true,
+				"report_data":        expectedReportData,
+				"app_info": map[string]string{
+					"compose_hash":      testHash,
+					"key_provider_info": hex.EncodeToString([]byte(`{"name":"kms","id":"3059301306072a8648ce3d020106082a8648ce3d030107034200040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}`)),
+				},
+			},
+		})
+	}))
+	defer verifier.Close()
+
+	s := &Server{
+		policy:      mustPolicy(t, `{"cluster":"demo","policy_epoch":1,"kms":{"name":"kms","id":"`+testKMSKey+`"},"workloads":[{"workload_id":"demo/worker/0/webdemo","identity":"spiffe://demo/webdemo","consul_service":"webdemo","allowed_compose_hashes":["`+testHash+`"]}]}`),
+		nonces:      NewNonceStore(time.Minute),
+		verifier:    &VerifierClient{URL: verifier.URL, HTTP: verifier.Client()},
+		issuer:      &recordingIssuer{token: "secret-token"},
+		tokenTTL:    time.Hour,
+		now:         func() time.Time { return time.Unix(100, 0).UTC() },
+		nonceRandom: bytes.NewReader(bytes.Repeat([]byte{0x55}, 32)),
+	}
+	ts := httptest.NewServer(s.routes())
+	defer ts.Close()
+
+	challengeResp, err := http.Post(ts.URL+"/v1/admission/challenge", "application/json", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var challenge struct {
+		Nonce string `json:"nonce"`
+	}
+	if err := json.NewDecoder(challengeResp.Body).Decode(&challenge); err != nil {
+		t.Fatal(err)
+	}
+	_ = challengeResp.Body.Close()
+
+	statement := `{"identity":"spiffe://demo/webdemo","peer_id":"worker-1"}`
+	expectedReportData, err = reportDataHex(hex.EncodeToString([]byte(statement)), challenge.Nonce)
+	if err != nil {
+		t.Fatal(err)
+	}
+	buf, _ := json.Marshal(map[string]any{
+		"identity":    "spiffe://demo/webdemo",
+		"binding":     hex.EncodeToString([]byte(statement)),
+		"nonce":       challenge.Nonce,
+		"attestation": "aabbcc",
+	})
+	resp, err := http.Post(ts.URL+"/v1/admission/attest", "application/json", bytes.NewReader(buf))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status = %d", resp.StatusCode)
+	}
+	var body map[string]string
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		t.Fatal(err)
+	}
+	if body["code"] != "KMS_POLICY_MISMATCH" {
+		t.Fatalf("wrong error body: %+v", body)
+	}
+}
+
 func TestAttestCarriesConsulPermissionsFromPolicy(t *testing.T) {
 	var expectedReportData string
 	verifier := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {