Add Azure support (for v3.4.0) #24
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a updated version of the previous PR because the latest commit at the time (v3.0.0) is now outdated.
It is created based on our current codebase which is based on 1fbac46 (This is the revision that is used by v3.4.0 release. https://github.com/privacysandbox/bidding-auction-servers/blob/v3.4.0/WORKSPACE), so we set the our copy of 1fbac46 as the target.
It targets our fork because we can't create a PR against commits without branch name or tag in https://github.com/privacysandbox/data-plane-shared-libraries.
The previous PR is left as it is because the branch is still used by our demo.
Adding Azure support
This PR is adding support for deployment of Google's Bidding and Auction Services on Azure.
Azure Privacy Sandbox architecture: https://1drv.ms/w/s!AmI-86sms1pYqJ5Uqgo5Qv2Ynmrcmw?e=BDC8BH
(We'll make a PR for the document in https://github.com/privacysandbox/protected-auction-services-docs/tree/main in future)
Now B&A services can fetch private and public HPKE keys from an Azure KMS, specifically designed to support the B&A services, and handle test requests.
To try this changes locally, please visit here.
The PR for bidding-auction-servers repository: KenGordon/bidding-auction-servers#19
azure-privacy-sandbox-kms branch that works with this PR: https://github.com/microsoft/azure-privacy-sandbox-kms/tree/add-azure-support-v3.4.0
Changes
--platform=azure(for Bazel),kAzure(C++ enum value).cpio/client_providers/attestationlibrary to fetch attestation in Azure Confidential ACI. We implemented the core functionality of:kms_client_providerparameter_client_providerprivate_key_fetcher_providerprivate_key_fetcher_provider.auth_token_providerrole_credentials_providerAlso we return dummy values for
instance_client_providerandblob_storage_client_providerfor now. Please see "TODOs for future PRs" section for the details.TODOs for future PRs
instance_client_providercurrently returns dummy values. It will be implemented properly after Azure auth_token_provider is ready.kKMSUnwrapPath. We will either put the URL inKeyData::key_encryption_key_urior use an environment variableauth_token_provideris using an environment variable to configure IDP path. We will try to find a better option.init_azureprivate_key_cache_ttl_secondsoption.key_idfor private key APIPrivateKeyFetchingRequest.azure_cpio_lib_inside_teeandazure_cpio_lib_outside_teeimplementation. Current azure_cpio_lib_inside_tee uses fake attestation report silently when it's outside TEE.blob_storage_client_provider. It just returns empty responses. We added it just to build errors when we runbuild_and_test_all_in_docker.azure_platformfortest_lib_cpio_provider