Lesson 6.3 · 13 min read

Custody, separation of duties and rotation

Who may change a release policy, how reference values roll forward, and how to revoke in an emergency.

Separation of duties

An attested key policy moves the critical decision from "who has the IAM role" to "which measurements are approved". That makes the reference-value list a high-value target. Split the duties so that no single person can both ship code and approve it to receive keys:

Duty	Holder	Cannot also
Build and sign images	CI pipeline (signing key in a KMS or HSM)	Edit key policies
Approve new reference values	Security officer / release manager	Push code to the release branch alone
Administer keys (rotation, deletion schedule)	Key custodians	Run the workload
Operate the workload	Platform / SRE team	Change measurements or key policies

Rolling reference values forward

New release is built in CI; measurements are published as an artifact.
Officer verifies the build provenance (Module 8) and approves the new values.
Policy is updated to accept both old and new values for the rollout window.
After rollout, the old values are removed. Leaving them indefinitely means old, possibly vulnerable builds can still get keys.

bash

# Find attested KMS activity for a key in CloudTrail (illustrative)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceName,AttributeValue=<key-arn> \
  --max-results 50

Review attested decrypt calls during an incident

Key takeaways

Reference values are now the gate; protect who can change them.
Accept old and new values only during a defined rollout window.
Rehearse emergency removal of a measurement from all policies.

References: AWS KMS condition keys for Nitro Enclaves, AWS KMS key policies, Google Cloud workload identity federation, Azure secure key release.

End of module 6

Take the module 6 quiz to check your understanding.