node: add amazon kms and benchmark signers #4148
Conversation
node/pkg/guardiansigner/amazonkms.go
Outdated
| return &amazonKmsSigner, nil | ||
| } | ||
|
|
||
| func (a *AmazonKms) Sign(hash []byte) (signature []byte, err error) { |
There was a problem hiding this comment.
I'm sorry if I failed to flag this before, but i think it would be ideal if both Sign and Verify were to have a context.Context parameter.
There was a problem hiding this comment.
Do you think I can just pass in the contexts that are available in the calling scope, and create a new one in scopes that don't have an existing context available?
There was a problem hiding this comment.
It's better than having no Context so I'm good with it.
| pubKey := b.innerSigner.PublicKey() | ||
|
|
||
| duration := time.Since(start) | ||
| fmt.Printf("Public key retrieval time: %v\n", duration) |
There was a problem hiding this comment.
This could be exposed through a Prometheus histogram.
There was a problem hiding this comment.
Here's an example of the definition of an histogram
wormhole/node/pkg/processor/processor.go
Line 169 in 02f468f
wormhole/node/pkg/processor/processor.go
Line 323 in 02f468f
| "time" | ||
| ) | ||
|
|
||
| type BenchmarkSigner struct { |
There was a problem hiding this comment.
IIUC this means we can benchmark AWS KMS signer by passing its configuration to a signer of type benchmark, correct?
Amazon KMS Guardian Signer
This PR adds an Amazon AWS KMS Guardian signer, allowing observations to be signed using KMS! The new signer can be used by specifying the ARN of the KMS key to use, through the
--guardianSignerUricommandline argument, as follows:--guardianSignerUri=amazonkms://<ARN>NOTE For the best possible performance, it is recommended that the Guardian be run from an EC2 instance that is in the same region as the KMS key.
The KMS key's spec should be
ECC_SECG_P256K1, and should be enabled for signing. In order for the Guardian to authenticate against the KMS service, one of two options are available:~/.aws/credentialsfile. (example here).