Managing Policies

The example in this section shows how to encrypt a file using a key stored in the Anjuna Policy Manager. For demonstration, you will run two simple Python 3 scripts that receive a password from the user, save it into an encrypted file, and then read the encrypted file and print the decrypted contents.

First, create a default manifest:

Start the Anjuna Policy Manager Broker in a different directory (replace anjuna-broker with a directory of your choice):

Start the Anjuna Policy Manager:

Add the following entries to your application’s manifest to connect to the Anjuna Policy Manager Server:

Copy the manifest field policy_manager printed by starting the Anjuna Policy Manager into the manifest template (manifest.template.yaml).

Next, edit the manifest template again, but this time add entries that specify a file that is encrypted automatically with a secret stored remotely in the Anjuna Policy Manager. Edit manifest.template.yaml and add the following lines to it:

The keys entry specifies a remote key with the ID of password_encryption_key, stored remotely inside the Anjuna Policy Manager with the path anjuna/encryption_keys/password.

The encrypted_files entry specifies that the file secret_password.encrypted should be encrypted using the key password_encryption_key (the previously defined remote key).

Now that the manifest template is set up, you need to compile it to create the manifest file and to create a signature file:

To add a secret to the Anjuna Policy Manager and attach it to the enclave, you will use the tool anjuna-policy-manager.

Before using anjuna-policy-manager to manage secrets, set up two environment variables that tell anjuna-policy-manager how to connect to the running Anjuna Policy Manager, and which CA certificate to use to set up the TLS connection to Anjuna Policy Manager:

Execute anjuna-policy-manager to create a new secret in the Anjuna Policy Manager:

After the secret is created inside the Anjuna Policy Manager, attach it to an enclave in order to grant permissions for that enclave to read the secret:

With the secret configured and attached to the enclave, you can now execute an application that uses that secret to encrypt a file. You will execute two Python scripts, one that receives a password from the user and saves it to the encrypted file, and one that reads the encrypted file and prints its decrypted contents to stdout. The Anjuna Runtime automatically encrypts the file when writing data to it and automatically decrypts the data when reading it.

Execute the first Python script that receives a password and saves it to the file using the Anjuna Runtime:

This command generates and encrypts the file secret_password.encrypted. You can see that the file has the Anjuna header for encrypted files by running the following command:

Now, execute another Python script that reads and prints the contents of the file inside the Anjuna Runtime. The Anjuna Runtime automatically decrypts the contents of the file.