We have decided to replace the current implementation with MAA Service Discovery API to get regional default provider and fill it in the template as following:
GET https://management.azure.com/subscriptions/{your_subscription}/providers/Microsoft.Attestation/Locations/{your_location}/defaultProvider?api-version=2020-10-01
This REST API is call to ARM, so all that's required is an Azure subscription and an identity (e.g., user, service principal, MSI identity, etc.) with RBAC permissions to access that subscription's resources.
For mooncake, Fairfax, USNAT and USSec the API part
/subscriptions/{your_subscription}/providers/Microsoft.Attestation/Locations/{your_location}/defaultProvider?api-version=2020-10-01
remain the same. But the arm endpoint https://management.azure.com/ will be different (see below),
Description of the new feature
Today default CVM SKR Policy is pull from a public Github repo
https://raw.githubusercontent.com/Azure/confidential-computing-cvm/main/cvm_deployment/key/skr-policy.json . This will hit performance issue with the expanding default policy file and also raising security concerns.
We have decided to replace the current implementation with MAA Service Discovery API to get regional default provider and fill it in the template as following:
The service discovery API from MAA:
Here is a reference application in Azure Powershell for default provider by location
This REST API is call to ARM, so all that's required is an Azure subscription and an identity (e.g., user, service principal, MSI identity, etc.) with RBAC permissions to access that subscription's resources.
The current implementation in the repo: https://github.com/Azure/azure-powershell/blob/37badb2ffe4fb193ca8d7c661328bea9eb52ec28/src/KeyVault/KeyVault/Commands/Key/AddAzureKeyVaultKey.cs#L77
Proposed implementation details (optional)
For mooncake, Fairfax, USNAT and USSec the API part
/subscriptions/{your_subscription}/providers/Microsoft.Attestation/Locations/{your_location}/defaultProvider?api-version=2020-10-01
remain the same. But the arm endpointhttps://management.azure.com/
will be different (see below),