azure-protected-secrets-tool - Man Page

azure-protected-secrets-tool COMMAND [ARGUMENT] [Options]
azure-protected-secrets-tool [-h|--help] [--version]

azure-protected-secrets-tool is the command-line front-end to the Azure CVM Secrets Provisioning Library (SSPL). It detects the confidential-computing isolation environment of the host and decrypts secrets that were provisioned to the VM by the Azure control plane and sealed to the virtual TPM (vTPM).

The commands that touch the vTPM (is-secrets-provisioning-enabled, unprotect-secret) typically require access to the TPM resource-manager device (/dev/tpmrm0) and therefore must be run as root on a Confidential VM. The is-cvm command only reads the hardware report and does not require elevated privileges.

is-cvm

Report the confidential-computing isolation type of the host. Output is of the form isolation_type=<TYPE> hypervisor=<NAME>, where TYPE is SNP (AMD SEV-SNP), TDX (Intel TDX), or NONE (not a Confidential VM). Returns a non-zero exit status when the host is not a Confidential VM.

is-secrets-provisioning-enabled

Report whether secrets provisioning has been enabled on this VM by checking for the presence of the provisioning key in the vTPM. Prints enabled=true or enabled=false.

unprotect-secret [TOKEN]

Decrypt a host-protected secret. The protected secret is supplied as a JSON Web Token (JWT), either as the inline TOKEN positional argument or, when omitted, read from standard input. The decrypted secret is written to standard output.

validate-imds-metadata

Perform two-level verification of the Azure Instance Metadata Service (IMDS) attestation blob.

--policy N

For unprotect-secret, set the unseal policy bitmask to the unsigned integer N. When omitted the policy defaults to 0.

--json

Emit machine-readable JSON instead of the default human-readable output. Supported by the reporting commands (for example is-cvm).

-h,  --help

Print a usage summary and exit.

--version

Print the library version and exit.

0

Success. For is-cvm, indicates the host is a Confidential VM.

non-zero

An error occurred, or for is-cvm the host is not a Confidential VM.

Detect the isolation type on a CVM:

$ azure-protected-secrets-tool is-cvm
isolation_type=SNP hypervisor=Microsoft Hv

The same, as JSON:

$ azure-protected-secrets-tool is-cvm --json
{"isolation_type":"SNP","hypervisor":"Microsoft Hv"}

Unprotect a secret supplied on standard input, applying policy 2:

$ azure-protected-secrets-tool unprotect-secret --policy 2 < token.jwt

Project homepage: https://github.com/Azure/confidential-computing-cvm-guest-attestation

Microsoft Corporation.