Anjuna Nitro Enclave Configuration

The Anjuna Nitro Enclave Configuration file contains information that the Anjuna Nitro Runtime needs to set up the application’s environment and start the application in an AWS Nitro Enclave.

You can specify the Anjuna Nitro Enclave Configuration file when building the Enclave Image File (EIF) with the anjuna-nitro-cli build-enclave command.

anjuna-nitro-cli build-enclave --docker-uri nginx:latest --output-file nginx.eif --enclave-config-file config.yaml

The Anjuna Nitro Enclave Configuration file allows you to configure the application running in the enclave (without changing the Docker image used to create the EIF):

Setting up new environment variables (or overriding existing ones).
Adding files to the application’s file system.
Setting the hostname of the enclave.
Selecting ports to expose.
Changing the command that starts the application in the enclave.
Specifying the S3 bucket that contains secrets for the application running in the enclave.

Nitro Enclave Configuration Entries

The Nitro Enclave Configuration should be a valid YAML file.

Version

The Nitro Enclave Configuration must contain a version entry:

version: 1.6

The Anjuna Nitro Runtime v1.27.0004 supports AWS Nitro Enclave Configuration v1.6 and below.

Environment variables

The environment entry contains an array of strings, where each string represents an environment variable and its value. The string should have the following format:

name=value

For example:

environment:
  - NGINX_HOST=foobar.com
  - NGINX_PORT=80

The variables defined in this section override the ones that were defined in the Docker container.

The value for an environment variable must be a literal (i.e. references to other environment variables are not supported).

Configuration files

The files entry contains an array of files with the following attributes:

path (required): The path where the file will be created. The Anjuna Nitro Runtime will create the intermediate directories if they don’t exist.
mode (optional): The permissions on the file (in octal notation). The default value is 0644 (which maps to [-rw-r—r--] in symbolic notation).
owner (optional): The owner (user) of the file. The default value is root.
group (optional): The owner (group) of the file. The default value is the user owner.
content (optional): The content of the file (if not provided, an empty file will be created).

files:
- path:  "/my-application/etc/config.toml"
  mode:  0644
  owner: root
  group: root
  content: |
    [database]
    server = "192.168.1.1"
    ports = [ 8000, 8001, 8002 ]
    connection_max = 5000
    enabled = true

This example defines the file /my-application/etc/config.toml with the following content:

[database]
server = "192.168.1.1"
ports = [ 8000, 8001, 8002 ]
connection_max = 5000
enabled = true

Exposed Ports

Use the exposedPorts: entry to specify one or more ports to expose from the AWS Nitro Enclave.

If the exposedPorts: entry is not added, then all ports will be exposed.

When using the exposedPorts: entry without specifying any ports, then all ports will be exposed.

Example for exposing ports 443 and 80:

exposedPorts:
  - 443
  - 80

Container Command

The Anjuna Nitro Runtime executes the command specified by the ENTRYPOINT and CMD entries from the original Dockerfile. If you want to override this value, you can specify the application and its command-line arguments.

command: [program, 1st_arg, 2nd_arg, ...]

Note that the syntax above can alternatively be written like this for the same result:

command:
  - program
  - 1st_arg
  - 2nd_arg
  - ...

Hostname

You can change the default hostname of the enclave to any value with the hostname field.

hostname: anjuna-enclave

The value of hostname is inserted automatically in the file /etc/hosts on the file system of the application running in the AWS Nitro Enclave.

Encrypted Configuration Files

The Anjuna Nitro Enclave Configuration file is inserted into the EIF in the same area as the application, and as such, it affects the PCR2 measurement.

However, this configuration file is not encrypted and you should not insert sensitive data (secrets) in this file. To securely provide secrets to your application, use the anjuna-nitro-encrypt tool to encrypt a configuration file with an AWS KMS key and upload it to an S3 bucket.

You can then add the location of the S3 bucket in the Nitro Enclave Configuration, which allows the Anjuna Nitro Runtime to download and decrypt the encrypted secrets (as long as the AWS Nitro Enclave is allowed to decrypt data using the AWS KMS key).

To specify the location of the S3 bucket, add the environment variable NITRO_ATTESTED_CONF_URL to the Anjuna Nitro Enclave Configuration file.

environment:
  - NGINX_HOST=foobar.com
  - NGINX_PORT=80

attestedConfURL: s3://my-bucket.nitro.my-application/kms-encrypted-data.bin

The Encrypted Configuration file has the same format as the Anjuna Nitro Enclave Configuration file. Entries defined in the Encrypted Configuration file override entries defined in the Anjuna Nitro Enclave Configuration file.

Persistent Storage Mounts

The mounts entry contains an array of mounts with the following attributes:

type (required): The type of the mount; should be basic
name (required): The name of the volume mount
mountPath (required): The path to mount the volume to inside the enclave

mounts:
- type: basic
  name: example-volume
  mountPath: /shared/example-volume

Untrusted Configuration

The Anjuna Enclave Configuration provides the user a configuration that is trusted, either through the configuration file attached at enclave-build-time or through an encrypted configuration file. However, there are cases where one needs to provide data to the software running in an enclave that is not known in advance and does not need to be trusted. For example, the IP address of a logging server. For such needs, the Anjuna Nitro Runtime provides a way to set such untrusted configuration.

An Enclave can fetch values for environment variables that do not affect the Enclave’s measurements and do not need to be attested. The configuration entry untrustedConfig and its sub-entries, envVars and allow, contain an array of environment variables to pull from the parent EC2 instance or from a Kubernetes ConfigMap.

For detailed information about fetching information from a non-attested and non-measured configuration, refer to the Untrusted Configuration section.

untrustedConfig:
  envVars:
    allow:
      - LOG_SERVER_ADDRESS
      - LOG_LEVEL

This example configuration allows the Enclave to fetch the environment variables LOG_SERVER_ADDRESS and LOG_LEVEL from the parent EC2 instance.

Example

Here is a complete example of a Nitro Enclave Configuration:

version: 1.6

environment:
  - MY_APP_HOST=anjuna-enclave
  - MY_APP_CONFIG=/my-application/etc/config.toml

attestedConfURL: s3://my-bucket.nitro.my-application/kms-encrypted-data.bin

hostname: anjuna-enclave

command: [nginx-debug, '-g', 'daemon off;']

files:
- path:  "/my-application/etc/config.toml"
  mode:  0644
  owner: root
  group: root
  content: |
    [database]
    server = "192.168.1.1"
    ports = [ 8000, 8001, 8002 ]
    connection_max = 5000
    enabled = true

exposedPorts:
  - 8000
  - 8001
  - 8002

mounts:
- name: app-data
  type: basic
  mountPath: /shared/app-data