How KMS integration works

KMS integration keeps private keys secure by performing signing operations within the external KMS without exposing the keys to Trusted Artifact Signer components.

How KMS integration works
Copy link

When a component operates in KMS mode, all private key operations (such as signing) are performed by the external KMS service. The component sends the data to be signed to the KMS, which performs the signing operation using the stored private key and returns the signature. The private key never leaves the KMS infrastructure, providing an additional layer of security.

Table 1. Signing responsibilities for Trusted Artifact Signer components
Component What it signs with the KMS key

Rekor

Each transparency-log entry

Fulcio

Each short-lived code-signing certificate it issues to a client

Timestamp Authority

Each RFC 3161 timestamp response