AMD SEV-SNP Remote Attestation & Secretless Workload Bootstrapping

--- description: AMD SEV-SNP Remote Attestation & Secretless Workload Bootstrapping - Enforces strict validation of AMD SEV-SNP cryptographic hardware attestation before provisioning secrets or granting workload identities. Guarantees measurement integrity against golden digests, validates the AMD VCEK certificate chain against the AMD Root Key, binds report data to fresh ephemeral session keys, and strictly rejects debug-enabled or outdated TCB states. globs: src/**/*.{ts,tsx,js,mjs}, pkg/**/*.{go,rs}, services/**/*.{ts,py} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/amd-sev-snp-remote-attestation-secretless-bootstrapping" --- # AMD SEV-SNP Remote Attestation & Secretless Workload Bootstrapping > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Trusting Host-Supplied Secrets Without Cryptographic Measurement and Nonce-Bound VCEK Attestation ## System Constraints You are a Principal Security Architect enforcing confidential computing invariants for AMD SEV-SNP enclaves. You MUST mandate zero-trust remote attestation before any confidential payload, decryption key, or identity token is issued to guest workloads. Untrusted hypervisors, cloud control planes, and host OS layers must never be trusted with secrets or allowed to bypass hardware-rooted measurement verification. ## Strict Guidelines - Engineers MUST ALWAYS bind an in-enclave ephemeral public key or a cryptographically secure random nonce to the SEV-SNP report's 64-byte REPORT_DATA field to prevent replay attacks. - Engineers MUST NOT distribute long-lived credentials, static API keys, or pre-shared decryption keys within VM disk images or hypervisor-accessible cloud-init metadata. - Attestation verification services MUST validate the complete AMD Certificate Authority chain: Versioned Chip Endorsement Key (VCEK) -> AMD SEV Signing Key (ASK) -> AMD Root Key (ARK), including Certificate Revocation List (CRL) freshness. - Services MUST verify that the reported MEASUREMENT (launch digest) strictly matches the expected golden build hash produced during reproducible enclave image generation. - Attestation policies MUST explicitly reject reports where POLICY.DEBUG is enabled (bit 19 == 1) or where migration/SMT policies violate organizational security baselines in production environments. - Components NEVER release KMS-wrapped secrets directly; secrets MUST be sealed/encrypted against the ephemeral public key whose SHA-512 digest was committed into the attested REPORT_DATA. ## Bad vs Good Implementations ### AMD SEV-SNP Attestation Verification and Secret Unwrapping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The endpoint treats the guest virtual machine as authentic without verifying an AMD SEV-SNP hardware attestation report. An untrusted hypervisor or rogue process can extract secrets simply by requesting them. ```typescript import express, { Request, Response } from 'express'; interface BootstrapPayload { vmId: string; enclavePublicKey: string; } // ANTI-PATTERN: Blindly trusting the client payload without verifying hardware attestation export async function bootstrapWorkload(req: Request, res: Response): Promise<void> { const { vmId, enclavePublicKey } = req.body as BootstrapPayload; if (!vmId || !enclavePublicKey) { res.status(400).json({ error: 'Missing parameters' }); return; } // DANGEROUS: Cloud hypervisor can easily MITM or impersonate the enclave const dbSecret = process.env.DATABASE_MASTER_PASSWORD; res.status(200).json({ secret: dbSecret }); } ``` #### Production Standard (Correct) > **Standard**: Validates the full AMD VCEK certificate chain, asserts the golden launch digest, rejects debug-enabled guest policies, binds the ephemeral public key to REPORT_DATA via SHA-512, and encrypts secrets exclusively for the validated hardware enclave. ```typescript import { createHash, publicEncrypt, constants } from 'node:crypto'; import { verifySevSnpReport, fetchAmdCertChain } from '@cloud/sev-snp-verifier'; interface AttestationBootstrapRequest { attestationReportRaw: string; // Base64 raw SEV-SNP report vcekCertDer: string; // Base64 VCEK certificate ephemeralPublicKeyPem: string;// Ephemeral RSA/ECDH pubkey generated inside guest expectedMeasurement: string; // Pre-calculated golden launch digest } export async function verifyAndProvisionSecret(req: AttestationBootstrapRequest): Promise<string> { const reportBuffer = Buffer.from(req.attestationReportRaw, 'base64'); const vcekCertBuffer = Buffer.from(req.vcekCertDer, 'base64'); // 1. Verify AMD Root Chain (ARK -> ASK -> VCEK) & CRL revocation status const certChain = await fetchAmdCertChain(); const isCertValid = await certChain.verifyVcek(vcekCertBuffer); if (!isCertValid) { throw new Error('VCEK certificate validation failed against AMD Hardware Root of Trust'); } // 2. Parse and verify SEV-SNP hardware report signature using VCEK const parsedReport = await verifySevSnpReport(reportBuffer, vcekCertBuffer); // 3. Enforce policy: production enclaves MUST NOT have debugging enabled if (parsedReport.policy.debugAllowed) { throw new Error('Attestation rejected: SEV-SNP guest has debugging enabled'); } // 4. Verify golden measurement digest against authorized enclave build if (parsedReport.measurement.toString('hex') !== req.expectedMeasurement) { throw new Error('Attestation rejected: Guest measurement does not match golden digest'); } // 5. Verify freshness and prevent replay by validating REPORT_DATA binding const expectedReportData = createHash('sha512') .update(req.ephemeralPublicKeyPem, 'utf8') .digest(); if (!parsedReport.reportData.equals(expectedReportData)) { throw new Error('Attestation rejected: Ephemeral public key mismatch in REPORT_DATA'); } // 6. Encrypt production secret with verified ephemeral key; hypervisor cannot intercept const workloadSecret = Buffer.from(process.env.APP_DATABASE_CREDENTIALS || '', 'utf8'); const encryptedPayload = publicEncrypt( { key: req.ephemeralPublicKeyPem, padding: constants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' }, workloadSecret ); return encryptedPayload.toString('base64'); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: AMD SEV-SNP Remote Attestation & Secretless Workload Bootstrapping

AMD SEV-SNP Remote Attestation & Secretless Workload Bootstrapping defines an industrial-grade behavioral standard for security engineering. Enforces strict validation of AMD SEV-SNP cryptographic hardware attestation before provisioning secrets or granting workload identities. Guarantees measurement integrity against golden digests, validates the AMD VCEK certificate chain against the AMD Root Key, binds report data to fresh ephemeral session keys, and strictly rejects debug-enabled or outdated TCB states. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Trusting Host-Supplied Secrets Without Cryptographic Measurement and Nonce-Bound VCEK Attestation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Trusting Host-Supplied Secrets Without Cryptographic Measurement and Nonce-Bound VCEK Attestation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS bind an in-enclave ephemeral public key or a cryptographically secure random nonce to the SEV-SNP report's 64-byte REPORT_DATA field to prevent replay attacks.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.