Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deployment changes for MVA lambda function. #2339

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

ajinkya-ghonge
Copy link

Summary:

Context

As part of KIA - ALS integration. I added logic required for PCR measurement validation to KIA lambda function. As part of this integration, the Lambda function needs to temporarily assume a different IAM role to query the Meta AWS deployed QLDB, validate the measurements and then assume it's original IAM role. While the KIA-ALS integration worked fine, the function was not able to assume it's original role post that. Based on further investigation I see hopping back and forth between IAM roles is not supported right now in AWS Lambda function. In order to solve this issue, I am moving the measurement validation logic to a new lambda that will be invoked from KIA.
Thus, KIA will now invoke this new lambda with the PCRs and QLDB parameters. The new Measurement Validation Agent, will assume the role provided, validate the measurements and return back Success/Failure status back to KIA. Based on the Successful measurement validation then, KIA will proceed with the encryption and on Faillure will terminate the process with a Failed status.

Changes in the stack

  1. Add a new QLDB repo handler : This handler will create the ALS QLDB repository.
  2. Add a Measurement validation handler : This handler will hold logic to validate the measurements.
  3. Add Measurement validation Runner : Entry point of the lambda function, this will validate the input and call the handlers.
  4. Add Deployment changes for the new lambda : Changes need to deploy the new lambda as part of CB AWS infra.
  5. Invoke Lambda from KIA : Add changes required to invoke the MVA lambda from KIA.
  6. Add deployment changes for KIA : As part of this, we will need to pass the MVA lambda function name to KIA, add changes to deployment script for that.
  7. Remove Measurement validation code from KIA : Now that the measurement validation logic is moved to a new lambda function, remove it from KIA.
  8. Changes to undeploy MVA lambda : Add changes to undeploy MVA lambda when CB is uninstalled.
  9. Add changes to CB API to pass QLDB parameters to KIA.
  10. Add changes to Coordinator to pass QLDB parameters to CB.

Changes in this diff

Add Deployment changes for the new lambda : Changes need to deploy the new lambda as part of CB AWS infra.

Differential Revision: D49374679

Ajinkya Ghonge and others added 2 commits September 18, 2023 09:35
Differential Revision: D49209824

fbshipit-source-id: a64b2eda2df723b205a652860b93496df586c052
Summary:
# Context
As part of KIA - ALS integration. I added logic required for PCR measurement validation to KIA lambda function. As part of this integration, the Lambda function needs to temporarily assume a different IAM role to query the Meta AWS deployed QLDB, validate the measurements and then assume it's original IAM role. While the KIA-ALS integration worked fine, the function was not able to assume it's original role post that. Based on further investigation I see hopping back and forth between IAM roles is not supported right now in AWS Lambda function. In order to solve this issue, I am moving the measurement validation logic to a new lambda that will be invoked from KIA.
Thus, KIA will now invoke this new lambda with the PCRs and QLDB parameters. The new Measurement Validation Agent, will assume the role provided, validate the measurements and return back Success/Failure status back to KIA. Based on the Successful measurement validation then, KIA will proceed with the encryption and on Faillure will terminate the process with a Failed status.

# Changes in the stack
1. Add a new QLDB repo handler : This handler will create the ALS QLDB repository.
2. Add a Measurement validation handler : This handler will hold logic to validate the measurements.
3. Add Measurement validation Runner : Entry point of the lambda function, this will validate the input and call the handlers.
4. Add Deployment changes for the new lambda : Changes need to deploy the new lambda as part of CB AWS infra.
5. Invoke Lambda from KIA :  Add changes required to invoke the MVA lambda from KIA.
6.  Add deployment changes for KIA : As part of this, we will need to pass the MVA lambda function name to KIA, add changes to deployment script for that.
7. Remove Measurement validation code from KIA : Now that the measurement validation logic is moved to a new lambda function, remove it from KIA.
8. Changes to undeploy MVA lambda : Add changes to undeploy MVA lambda when CB is uninstalled.
9. Add changes to CB API to pass QLDB parameters to KIA.
10. Add changes to Coordinator to pass QLDB parameters to CB.

# Changes in this diff
Add Deployment changes for the new lambda : Changes need to deploy the new lambda as part of CB AWS infra.

Differential Revision: D49374679

fbshipit-source-id: 75f4b1af783351f9d316b5d470dcd921bf5f7d3e
@facebook-github-bot facebook-github-bot added CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. fb-exported labels Sep 18, 2023
@facebook-github-bot
Copy link
Contributor

This pull request was exported from Phabricator. Differential Revision: D49374679

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. fb-exported
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants