Use TPM for Boto3 connection through proxy

[kmeng1219]

Is it possible to use TPM key/cert for boto3 connection through proxy? Following are links for boto3 client and botocore configuration.

https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/session.html#boto3.session.Session.client
https://botocore.amazonaws.com/v1/documentation/api/latest/reference/config.html

[aBurmeseDev]

Hi @kmeng1219, thanks for reaching out.
I’m not very familiar with TPM keys and was not able to find anything related in Boto3 doc as well. That might be something we do not support. However, I can bring it up to team discussion if you could provide an example of your workflow or use case scenario.

[kmeng1219]

@aBurmeseDev Thanks for your response. Please see the following some code:

    s3_config = Config(
		endpoint_discovery_enabled=True,
		proxies={
			'https': proxy_server_url
		},
		proxies_config={
			'proxy_use_forwarding_for_https': True,
		},
		client_cert=(client_cert_path, client_key_path)
    )

    client = boto3.client('s3',
        aws_access_key_id=access_key,
        aws_secret_access_key=secret_key,
        aws_session_token=token,
        config=s3_config,
        use_ssl= True,
        verify=ca_cert_bundle
    )

Pay attention to the 'client_cert'. The above code works with traditional cert and key. But TPM key needs to be loaded with TPM engine. Do you have TPM support in Boto3 / botocore?

[aBurmeseDev]

Hi @kmeng1219. Unfortunately, it seems like Boto3 doesn’t support TPM key at the moment. However, this could possibly be considered a cross-SDK feature request.

[matthewwedlow]

@aBurmeseDev any guidance on how to request this as a feature request? Thanks

[ashokbalaraman]

@aBurmeseDev : Is it possible to get the keys from TPM using openssl and pass it to Boto3 for mTLS?

[aBurmeseDev]

@matthewwedlow Thanks for your interest in requesting this feature. As we are trying to maintain consistency across SDKs, this feature request would have to be considered at a cross-SDK level. So I will transfer this issue to our cross-SDK repo here and bring it up with the appropriate internal teams. But I can't guarantee that your request would be considered. If you or anyone else can share any more info on why this feature is needed that could help.