cyber.hendryadrian.com
Security Insights · aws.amazon.com

AWS Shows How Managed Services Can Improve SPIRE Security and Resiliency

· Original article ↗

Summary

AWS explains how to integrate SPIRE with managed services for SVID signing, datastore availability, certificate authority functions, trust-bundle distribution, serverless SVID storage, and fine-grained authorization.

Key points

  • AWS KMS can provide signing keys for SPIRE-issued SVIDs, with key policies and CloudTrail auditing.
  • Amazon Aurora can replace SPIRE’s default SQLite datastore, with managed failover, backups, and maintenance.
  • AWS Private CA can serve as the upstream authority for SPIRE’s certificate authority.
  • Amazon S3 can publish trust bundles independently of SPIRE server availability; CloudFront can distribute them globally.
  • A SPIRE agent can use the Secrets Manager SVID store plugin to deliver identities for workloads that cannot run an agent, including serverless workloads.
  • Amazon Verified Permissions can evaluate authorization policies using workload identities such as SPIFFE IDs and JWT-SVIDs.
  • The post provides configuration examples and a reference architecture deployment through a sample repository.

Article Details

Topic
Using AWS managed services to improve SPIRE workload-identity security and resiliency

Vendors

Amazon Web ServicesIn this post, we show you how to address each of these considerations by offloading SPIRE core functionality to AWS managed services.

Products

Amazon AuroraSPIRE datastore using Amazon AuroraAmazon CloudFrontGlobal distribution: Distribute the trust bundle using Amazon CloudFront, improving performance through the CloudFront global edge network with over 750 Points of PresenceAmazon S3SPIRE bundle publisher using Amazon S3Amazon Verified PermissionsOne managed service that helps you do that in the context of SPIFFE and SPIRE implementations is Amazon Verified Permissions.AWS KMSSPIRE Key Manager using AWS KMSAWS Private Certificate AuthorityFor example, if you already have an AWS Private Certificate Authority (AWS Private CA) certificate authority deployed in your environment, you can use that for your SPIRE implementation and avoid provisioning a newAWS Secrets ManagerSVIDStore: The SPIRE Agent also stores SVIDs in other destinations, such as AWS Secrets Manager or HashiCorp Vault making them available for workloads running in serverless environments.SPIRESPIRE (the SPIFFE Runtime Environment) is an open source implementation of SPIFFE.

Related Articles