Fortanix CCM - Quickstart

1.0 Introduction

This article describes how to deploy and run applications using Fortanix Confidential Computing Manager (CCM) on the Fortanix Armor platform.

Fortanix CCM enables applications to run in a confidential computing environment. It manages application deployment, code attestation, identity verification, and access control to help ensure that applications run only on trusted infrastructure.

This article describes the basic workflow for setting up and running an application in Fortanix CCM, including:

Signing up and logging in to the Fortanix Armor
Creating and selecting an account in Fortanix Armor
Creating groups in Armor Identity and Access Management (IAM) to organize resources and manage access
Adding an application
Creating and approving an application build
Enrolling compute nodes
Running the application on enrolled compute nodes

By the end of this article, you will deploy an application build and run it on an enrolled compute node using Fortanix CCM.

2.0 Prerequisites

Ensure the following:

Access to the Fortanix Armor platform.
A private Docker registry to push converted application build(s).
An active Microsoft Azure subscription account.

3.0 Access Fortanix CCM

Fortanix CCM is a solution available on the Fortanix Armor platform. To access Fortanix CCM, you must have access to Fortanix Armor and an Armor account.

3.1 New Users

If you are new to Fortanix Armor, first complete the registration and account setup described in Getting Started with Fortanix Armor SaaS and Access and Set Up Fortanix Armor.

3.2 Existing Users

If you already have a Fortanix Armor account, log in to Fortanix Armor and select the account you want to use with CCM.

4.0 Create a Group

Groups are used in Fortanix CCM to organize users and manage access to CCM resources such as applications, datasets, workflows, scripts, connectors, and application configurations. You must create a group using the Fortanix Armor Identity and Access Management user interface (UI).

For more information on how to create a group in Fortanix Armor, refer to Fortanix Armor Identity and Access Management (IAM).

5.0 Getting Started with Fortanix CCM

This section describes the steps to deploy and run an application using Fortanix CCM.

The workflow begins with signing up for the Fortanix Armor platform and accessing the Fortanix CCM solution. After creating a Fortanix Armor account and a group, create an application, create and approve an application build, and deploy the approved build to compute nodes enrolled with Fortanix CCM.

The following sections provide step-by-step instructions for each stage of the process.

5.1 Add an Application

Perform the following steps to add an application:

In the CCM left navigation panel, click Applications.
On the ACTIVE APPLICATIONS tab, click ADD APPLICATION to add an application.
In this example, an Enclave OS application running a Python Flask server is used.
In the Add Application form,
1. Under Select application type, select Confidential Container - Enclave OS.
2. Under Select platform type, select AWS Nitro.
3. Click NEXT to proceed to create the application.
Figure 1: Add an Confidential Container - Enclave OS application on AWS Nitro platform
NOTE
This article covers an example of deploying and running an Enclave OS (Operating System) application using Fortanix CCM.
In the Add Application Enclave OS form, enter the required details and click ADD APPLICATION. For this example, use a sample application image from the Fortanix public Docker registry
Details:
Docker Hub: https://hub.docker.com/u/fortanix/
Optional: To run the sample application, use the following command:
```
sudo docker run fortanix/python-flask
```
NOTE
It is recommended to use a private Docker registry to store the output image.

For detailed instructions, refer to the following articles:

To create a Confidential Container - Enclave OS (Operating System) application on AWS Nitro, refer to Add Confidential Container - Enclave OS Application - AWS Nitro.
To create a Confidential Container - Enclave OS (Operating System) application on AMD SEV-SNP, refer to Add Confidential Container - Enclave OS Application - AMD SEV-SNP.
To create a Confidential Container - Enclave OS (Operating System) application on Intel TDX, refer to Add Confidential Container - Enclave OS Application - Intel TDX.
To create an Enclave Development Platform (EDP) application, refer to Add EDP Application.
To create an Azure ACI (Azure Container Instances) application, refer to Add Azure ACI Application.
To create an Azure Confidential VM (Virtual Machine) application, refer to Add Azure Confidential VM Application.
To create a Confidential VM application on the Intel TDX (Trust Domain Extensions) platform, refer to Add Confidential VM Application - InteI TDX.
To create a Confidential VM application on AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) platform, refer to Add Confidential VM Application - AMD-SEV SNP.
To create a Confidential Container - CoCo application on the AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) platform, refer to Add Confidential Container - CoCo Application - AMD SEV-SNP.
To create a Confidential Container - CoCo application on the Intel TDX (Trust Domain Extensions) platform, refer to Add Confidential Container - CoCo Application - Intel TDX.

5.2 Create an Application Build

A Fortanix CCM build represents a specific version of an application. Each build contains platform-specific verification information that Fortanix CCM uses during attestation and workload validation.

Perform the following steps to create an application build:

After you create an Enclave OS application, go to the application details page.
Click ADD BUILD to create a build for the Enclave OS application.
In the Add Build form, enter the required details and click ADD BUILD.

After the application build is created successfully, Fortanix CCM displays a confirmation notification, and the build appears on the BUILDS page.

For detailed instructions, refer to the following articles:

To add multiple application build registries, refer to Application Build Registry.
To create a Confidential Container - Enclave OS application build, refer to Create an Application Build for Enclave OS Applications.
To create an EDP application build, refer to Create an Application Build for EDP Applications.
To create an Azure ACI application build, refer to Create an Application Build for ACI Application.
To create an Azure Confidential VM application build, refer to Create an Application Build for Azure CVM Applications.
To create a Confidential VM application build on the AMD SEV-SNP platform, refer to Create an Application Build for AMD SEV-SNP Applications.
To create a Confidential VM application build on the Intel TDX platform, refer to Create an Application Build for Intel TDX Applications.
To create a Confidential Container - CoCo application build on the AMD SEV-SNP platform, refer to Create an Application Build for AMD SEV-SNP Applications.
To create a Confidential Container - CoCo application build on the Intel TDX platform, refer to Create an Application Build for Intel TDX Applications.

5.3 Approve the Application Build

Perform the following steps to approve the application build:

On the Tasks page, click the Build Whitelist for app: Enclave OS Application task in the Pending tab.
Figure 2: Approve the application image
Click APPROVE to whitelist the build.

For detailed instructions to approve or decline application domain and build whitelist tasks in Fortanix CCM, refer to Domain and Application Build Approval.

5.4 Enroll Compute Node Agent

This section describes how to enroll a compute node using AWS Nitro Enclaves on Amazon Linux in Fortanix CCM. After successful enrollment, approved application builds can run on the compute node.

For detailed instructions to set up the environment and enroll an AWS Nitro compute node, refer to Enroll a Compute Node Using AWS Nitro on Amazon Linux.

For detailed instructions to deploy confidential VM applications on Intel TDX using Fortanix CCM, refer to Deploy Confidential VM Applications on Intel TDX Using Fortanix CCM.
For detailed instructions to deploy confidential VM applications on AMD SEV-SNP using Fortanix CCM, refer to Deploy Confidential VM Applications on AMD SEV-SNP Using Fortanix CCM.
For detailed instructions to configure a Fortanix CCM deployment with an Azure Confidential Virtual Machine (CVM) Linux environment, refer to Azure Confidential VM Attestation - Linux.
For detailed instructions to configure a Fortanix CCM deployment with an Azure Confidential Virtual Machine (CVM) Windows environment, refer to Azure Confidential VM Attestation - Windows.

5.5 Run the Application Build

After enrolling the compute node, perform the following steps to run the application build on the AWS Nitro enrolled compute node:

Run the following command to install Docker on the enrolled compute node:
```
sudo apt install docker.io
```
Run the following command to run this application build on the node for AWS Nitro Platform:
```
sudo docker run -it --rm --privileged -v /run/nitro_enclaves:/run/nitro_enclaves -e RUST_LOG=debug -e NODE_AGENT=http://172.31.14.110:9092/v1/ -p 80:80 -p 443:443 513076507034.dkr.ecr.us-west-1.amazonaws.com/development-images/em-test-framework-nginx-9913:nitro
```
Where,
- 9092: The default port on which the Node Agent listens.
- 172.31.14.110: The Node Agent Host IP address.
- em-test-framework-nginx-9913:nitro: The converted application build displayed in the BUILDS table.
NOTE
Replace the Node Agent IP address, port number (if modified), and application build name with values specific to your environment. The example shown above is for reference only.

5.6 Azure Confidential VM - Setup and Attestation

For detailed steps on how to configure a Fortanix CCM deployment with an Azure Confidential Virtual Machine (CVM) environment, refer to the following guides:

Linux-based Azure CVM
- Azure Confidential VM Setup - Linux
- Azure Confidential VM Attestation - Linux
Windows-based Azure CVM
- Azure Confidential VM Setup - Windows
- Azure Confidential VM Attestation - Windows

5.7 Enroll Compute Node - Intel TDX

This section describes how to enroll a compute node using bare metal on an Intel TDX platform in Fortanix CCM.

For more information on how to set up the environment, refer to Enroll a Compute Node (bare metal)- Intel TDX.

For detailed steps on how to deploy confidential VM applications on Intel TDX using Fortanix CCM, click here.

5.8 Enroll Compute Node - AMD SEV-SNP

This section describes how to enroll a compute node using bare metal on an AMD SEV-SNP platform in Fortanix CCM.

For more information on how to set up the environment, refer to Enroll a Compute Node (bare metal) - AMD SEV-SNP.

For detailed steps on how to deploy confidential VM applications on AMD SEV-SNP using Fortanix CCM, click here.

6.0 Where to go from here

Congratulations, you have just deployed your first confidential computing application using the Fortanix Confidential Computing Manager!

After completing the setup, you can explore additional features of Fortanix CCM using the following resources:

Provision a TLS certificate using CCM: Add Application
Manage identities and enforce policies for applications and compute nodes
- Application and Compute Node Policy Enforcement
- Compute Nodes
Build and deploy confidential computing applications in RUST using the Fortanix EDP platform: Bringing EDP Rust Apps to Confidential Computing Manager.

For quick support, please join our Slack community: https://fortanix.com/community/ Channel: #enclavemanager