AZURE-PROTECTED-SECRETS-TOOL(1)

NAME
azure-protected-secrets-tool - inspect Azure Confidential VM state and unprotect host-provisioned secrets

SYNOPSIS
azure-protected-secrets-tool COMMAND [ARGUMENT] [OPTIONS]
azure-protected-secrets-tool [-h|--help] [--version]

DESCRIPTION
azure-protected-secrets-tool is the command-line front-end to the Azure CVM Secrets Provisioning Library (SSPL). It detects the confidential-computing isolation environment of the host and decrypts secrets that were provisioned to the VM by the Azure control plane and sealed to the virtual TPM (vTPM).

The commands that touch the vTPM (is-secrets-provisioning-enabled, unprotect-secret) typically require access to the TPM resource-manager device (/dev/tpmrm0) and therefore must be run as root on a Confidential VM. The is-cvm command only reads the hardware report and does not require elevated privileges.

COMMANDS

is-cvm
    Report the confidential-computing isolation type of the host. Output is of the form isolation_type=<TYPE> hypervisor=<NAME>, where TYPE is SNP (AMD SEV-SNP), TDX (Intel TDX), or NONE (not a Confidential VM). Returns a non-zero exit status when the host is not a Confidential VM.

is-secrets-provisioning-enabled
    Report whether secrets provisioning has been enabled on this VM by checking for the presence of the provisioning key in the vTPM. Prints enabled=true or enabled=false.

unprotect-secret [TOKEN]
    Decrypt a host-protected secret. The protected secret is supplied as a JSON Web Token (JWT), either as the inline TOKEN positional argument or, when omitted, read from standard input. The decrypted secret is written to standard output.

validate-imds-metadata
    Perform two-level verification of the Azure Instance Metadata Service (IMDS) attestation blob.

OPTIONS

--policy N
    For unprotect-secret, set the unseal policy bitmask to the unsigned integer N. When omitted the policy defaults to 0.

--json
    Emit machine-readable JSON instead of the default human-readable output. Supported by the reporting commands (for example is-cvm).

-h, --help
    Print a usage summary and exit.

--version
    Print the library version and exit.

EXIT STATUS

0   Success. For is-cvm, indicates the host is a Confidential VM.

non-zero
    An error occurred, or for is-cvm the host is not a Confidential VM.

EXAMPLES

Detect the isolation type on a CVM:

        $ azure-protected-secrets-tool is-cvm
        isolation_type=SNP hypervisor=Microsoft Hv

The same, as JSON:

        $ azure-protected-secrets-tool is-cvm --json
        {"isolation_type":"SNP","hypervisor":"Microsoft Hv"}

Unprotect a secret supplied on standard input, applying policy 2:

        $ azure-protected-secrets-tool unprotect-secret --policy 2 < token.jwt

SEE ALSO
Project homepage: https://github.com/Azure/confidential-computing-cvm-guest-attestation

AUTHOR
Microsoft Corporation.