search

amazonlinux / amazon-linux-2023

Amazon Linux 2023
https://aws.amazon.com/linux/amazon-linux-2023/
Other
521 stars 38 forks source link

[Feature Request] - Notifications for FIPS certificate changes #755

Open mvhowardAWS opened 1 month ago

mvhowardAWS commented 1 month ago

Is your feature request related to a problem? Please describe. Amazon Linux regularly works with NIST to have various packages FIPS certified as part of the Cryptographic Module Validation Program (CMVP). However, it's up to customers to regularly check the CMVP website or the relevant FAQ pages for AL2 and AL23 to see if there are updates to these certificates. Updates to certificates require customers compliance teams to update their documentation and work with their auditors to ensure these changes are reflected accurately.

For example:

Cert 3553 was moved to historical. https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3553 Cert 4490 was approved and moved to Active. https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4490

Describe the solution you'd like I'd like to see Amazon to notify me directly when a NIST certificate for a Amazon Linux package updates. One method could be via AWS Health Notification to my account. Alternatively, you could include it as part of release notes that I can subscribe to.

wrestcody commented 1 month ago

Currently having to manually search the CMVP portal to validate certificates. If an RSS, update, release note could be added for our team to monitor that would help. Also if an API was exposed we could automate the checks for easier management.