Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add the option to create a KMS key for signing of pipelines #1366

Merged
merged 7 commits into from
Sep 11, 2024
Merged

Add the option to create a KMS key for signing of pipelines #1366

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4439dbf
Add the option to create a KMS key for signing of pipelines
wolfeidau Sep 6, 2024
9d2e902
Add the configuration to the agent for the optional kms siging key
wolfeidau Sep 6, 2024
38bc536
Update the agent policy to grant access to signing kms key if present
wolfeidau Sep 6, 2024
e4cd1c7
Fix configuration of the agent kms signing key
wolfeidau Sep 10, 2024
e2b6872
Added export of KMS signing key and option to provide a signing key id
wolfeidau Sep 10, 2024
7eec529
Updated signed pipeline options to allow seperate sign and verify queues
wolfeidau Sep 11, 2024
466633d
Adjusted label to simplify heading
wolfeidau Sep 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions packer/linux/conf/bin/bk-install-elastic-stack.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,6 +291,7 @@ disconnect-after-idle-timeout=${BUILDKITE_SCALE_IN_IDLE_PERIOD}
disconnect-after-job=${BUILDKITE_TERMINATE_INSTANCE_AFTER_JOB}
tracing-backend=${BUILDKITE_AGENT_TRACING_BACKEND}
cancel-grace-period=${BUILDKITE_AGENT_CANCEL_GRACE_PERIOD}
signing-aws-kms-key=${BUILDKITE_AGENT_SIGNING_KMS_KEY}
EOF

if [[ "${BUILDKITE_ENV_FILE_URL}" != "" ]]; then
Expand Down
1 change: 1 addition & 0 deletions packer/windows/conf/bin/bk-install-elastic-stack.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,7 @@ shell=powershell
disconnect-after-idle-timeout=${Env:BUILDKITE_SCALE_IN_IDLE_PERIOD}
disconnect-after-job=${Env:BUILDKITE_TERMINATE_INSTANCE_AFTER_JOB}
tracing-backend=${Env:BUILDKITE_AGENT_TRACING_BACKEND}
signing-jwks-key-id=${Env:BUILDKITE_AGENT_SIGNING_KMS_KEY}
"@
$OFS=" "

Expand Down
39 changes: 39 additions & 0 deletions templates/aws-stack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -568,6 +568,14 @@ Parameters:
Description: Optional - Customise the EC2 instance Name tag
Default: ""

PipelineSigningKMSKeySpec:
Type: String
Description: The key spec for the KMS key used to sign and verify pipelines
AllowedValues:
- "ECC_NIST_P256"
- "none"
Default: "none"

Rules:
HasToken:
Assertions:
Expand Down Expand Up @@ -685,6 +693,9 @@ Conditions:

UseCostAllocationTags:
!Equals [ !Ref EnableCostAllocationTags, "true" ]

CreatePipelineSigningKMSKey:
!Not [ !Equals [ !Ref PipelineSigningKMSKeySpec, "none" ] ]

HasKeyName:
!Not [ !Equals [ !Ref KeyName, "" ] ]
Expand Down Expand Up @@ -871,6 +882,17 @@ Resources:
Name: !Sub "/${AWS::StackName}/buildkite/agent-token"
Type: String
Value: !Ref BuildkiteAgentToken

PipelineSigningKMSKey:
Type: AWS::KMS::Key
Condition: CreatePipelineSigningKMSKey
Properties:
Description: Key used to sign and verify pipelines
KeySpec: !Ref PipelineSigningKMSKeySpec
KeyUsage: SIGN_VERIFY
Tags:
- Key: Name
Value: !Sub '${AWS::StackName}-PipelineSigningKey'

# Allow ec2 instances to assume a role and be granted the IAMPolicies
IAMInstanceProfile:
Expand Down Expand Up @@ -903,6 +925,19 @@ Resources:
- !Ref 'AWS::NoValue'
- !Ref 'AWS::NoValue'
Policies:
- !If
- CreatePipelineSigningKMSKey
- PolicyName: PipelineSigningKMSKeyAccess
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- kms:GetPublicKey
- kms:Sign
- kms:Verify
Resource: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${PipelineSigningKMSKey}
- !Ref 'AWS::NoValue'
- !If
- UseCustomerManagedKeyForParameterStore
- PolicyName: DecryptAgentToken
Expand Down Expand Up @@ -1231,6 +1266,7 @@ Resources:
$Env:BUILDKITE_QUEUE="${BuildkiteQueue}"
$Env:BUILDKITE_AGENT_ENABLE_GIT_MIRRORS="${BuildkiteAgentEnableGitMirrors}"
$Env:BUILDKITE_ELASTIC_BOOTSTRAP_SCRIPT="${BootstrapScriptUrl}"
$Env:BUILDKITE_AGENT_SIGNING_KMS_KEY="${PipelineSigningKMSKey}"
$Env:BUILDKITE_ENV_FILE_URL="${AgentEnvFileUrl}"
$Env:BUILDKITE_AUTHORIZED_USERS_URL="${AuthorizedUsersUrl}"
$Env:BUILDKITE_ECR_POLICY="${ECRAccessPolicy}"
Expand All @@ -1248,6 +1284,7 @@ Resources:
LocalSecretsBucket: !If [ CreateSecretsBucket, !Ref ManagedSecretsBucket, !Ref SecretsBucket ],
LocalSecretsBucketRegion: !If [ CreateSecretsBucket, !Ref "AWS::Region", !Ref SecretsBucketRegion ],
AgentTokenPath: !If [ UseCustomerManagedParameterPath, !Ref BuildkiteAgentTokenParameterStorePath, !Ref BuildkiteAgentTokenParameter ],
PipelineSigningKMSKey: !If [ CreatePipelineSigningKMSKey, !Ref PipelineSigningKMSKey, "" ],
}
- !Sub
- |
Expand Down Expand Up @@ -1288,6 +1325,7 @@ Resources:
BUILDKITE_AGENT_TRACING_BACKEND="${BuildkiteAgentTracingBackend}" \
BUILDKITE_AGENT_RELEASE="${BuildkiteAgentRelease}" \
BUILDKITE_AGENT_CANCEL_GRACE_PERIOD="${BuildkiteAgentCancelGracePeriod}" \
BUILDKITE_AGENT_SIGNING_KMS_KEY="${PipelineSigningKMSKey}" \
BUILDKITE_QUEUE="${BuildkiteQueue}" \
BUILDKITE_AGENT_ENABLE_GIT_MIRRORS="${BuildkiteAgentEnableGitMirrors}" \
BUILDKITE_ELASTIC_BOOTSTRAP_SCRIPT="${BootstrapScriptUrl}" \
Expand All @@ -1310,6 +1348,7 @@ Resources:
LocalSecretsBucket: !If [ CreateSecretsBucket, !Ref ManagedSecretsBucket, !Ref SecretsBucket ],
LocalSecretsBucketRegion: !If [ CreateSecretsBucket, !Ref "AWS::Region", !Ref SecretsBucketRegion ],
AgentTokenPath: !If [ UseCustomerManagedParameterPath, !Ref BuildkiteAgentTokenParameterStorePath, !Ref BuildkiteAgentTokenParameter ],
PipelineSigningKMSKey: !If [ CreatePipelineSigningKMSKey, !Ref PipelineSigningKMSKey, "" ],
}

AgentAutoScaleGroup:
Expand Down