Merge pull request #61 from celestiaorg/tux/upgrade-kms

dep: upgrade kms

Author: tuxcanfly

README.md

@@ -37,9 +37,9 @@ The DA server signs transactions using a Celestia keyring. You have two options:
 - The key name must match your configuration (`default_key_name`)
 
 **Option 2: AWS KMS Keyring** (Recommended for production)
-- Key names are mapped to aliases
-- Supports importing existing keys for e.g.: keys generated by `cel-key`
-- Supports auto-creation of keys for simplified setup
+- Uses a single pre-configured KMS key
+- Minimal permissions: only `kms:GetPublicKey` and `kms:Sign` required
+- Key name `default_key_name` in the configuration corresponds to the KMS key alias or key ID
 - Works with LocalStack for local development
 
 **The server will not work without a properly configured keyring.**
@@ -70,48 +70,18 @@ celestia-appd keys show my_celes_key --keyring-backend test \
 #### Alternative: AWS KMS Keyring Backend
 
 Instead of a local keyring, you can use AWS KMS for signing Celestia transactions. This provides:
-- **Hardware security** - Keys are generated and stored in AWS KMS HSMs
+- **Hardware security** - Keys are stored in AWS KMS HSMs
 - **Remote signing** - No local key material needed
-- **Auto-creation** - Keys can be automatically created on first use
+- **Minimal permissions** - Only `kms:GetPublicKey` and `kms:Sign` required
 - **LocalStack support** - Test locally before deploying to AWS
 
-##### LocalStack Setup (Development/Testing)
-
-For local development, use LocalStack to emulate AWS KMS:
+##### Step 1: Create a KMS Key
 
 ```bash
-# Start LocalStack with KMS service
+# For LocalStack (development)
 docker run -d -p 4566:4566 localstack/localstack
 
-# Configure op-alt-da to use AWS KMS with auto-creation
-cat > config.toml <<EOF
-[celestia]
-keyring_backend = "awskms"
-default_key_name = "my_celes_key"
-# ... other celestia settings ...
-
-[celestia.awskms]
-region = "us-east-1"
-endpoint = "http://localhost:4566"  # LocalStack endpoint
-alias_prefix = "alias/op-alt-da/"
-auto_create = true  # Automatically create keys if they don't exist
-EOF
-
-# Run the server - the key will be auto-created on startup!
-./bin/da-server --config=config.toml
-```
-
-With `auto_create = true`, the server will automatically:
-1. Check if a KMS key with alias `alias/op-alt-da/<default_key_name>` exists
-2. If not found, create a new secp256k1 key in KMS
-3. Create the alias and start using it for signing
-
-**Manual Key Creation (Optional)**
-
-If you prefer to create keys manually or need to use existing keys:
-
-```bash
-# Create a secp256k1 key in LocalStack
+# Create a secp256k1 key
 KEY_ID=$(aws --endpoint-url=http://localhost:4566 kms create-key \
   --key-spec ECC_SECG_P256K1 \
   --key-usage SIGN_VERIFY \
@@ -120,35 +90,43 @@ KEY_ID=$(aws --endpoint-url=http://localhost:4566 kms create-key \
 
 # Create an alias for the key
 aws --endpoint-url=http://localhost:4566 kms create-alias \
-  --alias-name alias/op-alt-da/my_celes_key \
+  --alias-name alias/my_celes_key \
   --target-key-id $KEY_ID
-
-# Set auto_create = false in config.toml
 ```
 
-##### AWS Production Setup
+For production AWS, omit `--endpoint-url`.
 
-For production use with AWS KMS:
+##### Step 2: Configure the Server
 
 ```toml
 [celestia]
 keyring_backend = "awskms"
-default_key_name = "my_celes_key"
+default_key_name = "alias/my_celes_key"  # Use full alias name
+# ... other celestia settings ...
 
 [celestia.awskms]
 region = "us-east-1"
-endpoint = ""  # Leave empty for AWS
-alias_prefix = "alias/op-alt-da/"
-auto_create = false  # Disable auto-creation in production
-
-# Optional: Import an existing private key
-import_key_name = "my_celes_key"
-import_key_hex = "your-32-byte-hex-private-key"
+endpoint = "http://localhost:4566"  # Leave empty for AWS production
 ```
 
-**Important:** Ensure your AWS credentials are configured via environment variables, IAM role, or AWS credentials file. The server requires `kms:CreateKey`, `kms:CreateAlias`, `kms:GetPublicKey`, `kms:Sign`, and `kms:ListAliases` permissions.
+##### Step 3: Run the Server
 
-To export a key from celestia keystore, use `cel-key export --keyring-dir /path/to/keyring --unarmored-hex --unsafe my_celes_key`
+```bash
+./bin/da-server --config=config.toml
+```
+
+**IAM Permissions Required:**
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["kms:GetPublicKey", "kms:Sign"],
+    "Resource": "arn:aws:kms:REGION:ACCOUNT:key/KEY_ID"
+  }]
+}
+```
 
 ### 2. Build the Server
 
@@ -257,17 +235,13 @@ core_grpc_tls_enabled = true
 # Keyring
 keyring_backend = "test"  # or "awskms" for AWS KMS
 keyring_path = "~/.celestia-light-mocha-4/keys"
-default_key_name = "my_celes_key"
+default_key_name = "my_celes_key"  # For awskms, use full alias: "alias/my_celes_key"
 p2p_network = "mocha-4"
 
-# AWS KMS keyring
+# AWS KMS keyring (when keyring_backend = "awskms")
 [celestia.awskms]
 region = "us-east-1"
 endpoint = ""  # Set to http://localhost:4566 for localstack
-alias_prefix = "alias/op-alt-da/"
-auto_create = false  # Automatically create keys if they don't exist
-import_key_name = "my_celes_key"
-import_key_hex = "1234..."
 
 [submission]
 timeout = "60s"

celestia_storage.go

@@ -211,7 +211,9 @@ func initKeyring(ctx context.Context, cfg *RPCClientConfig) (keyring.Keyring, er
 		if cfg.TxClientConfig.AWSKMSConfig == nil {
 			return nil, fmt.Errorf("AWS KMS config is required when using awskms backend")
 		}
-		kr, err = awskeyring.NewKMSKeyring(ctx, keyname, *cfg.TxClientConfig.AWSKMSConfig)
+		kmsCfg := *cfg.TxClientConfig.AWSKMSConfig
+		kmsCfg.KeyName = keyname
+		kr, err = awskeyring.NewKMSKeyring(ctx, kmsCfg)
 	default:
 		kr, err = txClient.KeyringWithNewKey(txClient.KeyringConfig{
 			KeyName:     keyname,

cmd/daserver/config.go

@@ -382,17 +382,9 @@ func (c *Config) ToCelestiaRPCConfig() celestia.RPCClientConfig {
 			TxWorkerAccounts:   c.Celestia.TxWorkerAccounts,
 		}
 		if c.Celestia.KeyringBackend == "awskms" {
-			aliasPrefix := c.Celestia.AWSKMS.AliasPrefix
-			if aliasPrefix == "" {
-				aliasPrefix = "alias/op-alt-da/"
-			}
 			txCfg.AWSKMSConfig = &awskeyring.Config{
-				Region:        c.Celestia.AWSKMS.Region,
-				Endpoint:      c.Celestia.AWSKMS.Endpoint,
-				AliasPrefix:   aliasPrefix,
-				ImportKeyName: c.Celestia.AWSKMS.ImportKeyName,
-				ImportKeyHex:  c.Celestia.AWSKMS.ImportKeyHex,
-				AutoCreate:    c.Celestia.AWSKMS.AutoCreate,
+				Region:   c.Celestia.AWSKMS.Region,
+				Endpoint: c.Celestia.AWSKMS.Endpoint,
 			}
 		}
 	}

config.toml.example

@@ -98,14 +98,6 @@ tx_worker_accounts = 0
 region = "us-east-1"
 # Set to http://localhost:4566 for localstack testing. Leave empty for AWS.
 endpoint = ""
-alias_prefix = "alias/op-alt-da/"
-
-# Automatically create keys if they don't exist (useful for development/testing)
-auto_create = false
-
-# Optional: Import an existing private key into KMS on startup
-import_key_name = "my_celes_key"
-import_key_hex = ""
 
 # ==============================================================================
 # SUBMISSION CONFIGURATION

go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/config v1.31.17
 	github.com/aws/aws-sdk-go-v2/credentials v1.18.21
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.90.0
-	github.com/celestiaorg/aws-kms-keyring v0.4.0
+	github.com/celestiaorg/aws-kms-keyring v0.5.0
 	github.com/celestiaorg/celestia-node v0.28.4
 	github.com/celestiaorg/go-square/v3 v3.0.2
 	github.com/cosmos/cosmos-sdk v0.51.6

go.sum

@@ -795,8 +795,8 @@ github.com/bytedance/sonic v1.14.1/go.mod h1:gi6uhQLMbTdeP0muCnrjHLeCUPyb70ujhnN
 github.com/bytedance/sonic/loader v0.3.0 h1:dskwH8edlzNMctoruo8FPTJDF3vLtDT0sXZwvZJyqeA=
 github.com/bytedance/sonic/loader v0.3.0/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
-github.com/celestiaorg/aws-kms-keyring v0.4.0 h1:fGTE6a5VDcNht7lq0sQRLl9X9IHu4d0b6siwFJ7visQ=
-github.com/celestiaorg/aws-kms-keyring v0.4.0/go.mod h1:xNjA82rcQvZarKzhnmgwEPTN9TUm3SZUWYyX8YNDlkA=
+github.com/celestiaorg/aws-kms-keyring v0.5.0 h1:RLYfMdl0RQivv2YUnclszoO2uy6KvKaUCwjxbcOdeac=
+github.com/celestiaorg/aws-kms-keyring v0.5.0/go.mod h1:xNjA82rcQvZarKzhnmgwEPTN9TUm3SZUWYyX8YNDlkA=
 github.com/celestiaorg/boxo v0.29.0-fork-4 h1:A202u8w3Iqjw4ZlqSukfiMbefQEN+740GUj1Z3VI960=
 github.com/celestiaorg/boxo v0.29.0-fork-4/go.mod h1:rXql6ncaLZZfLqDG3Cuw9ZYQKd3rMU5bk1TGXF0+ZL0=
 github.com/celestiaorg/celestia-app/v6 v6.2.5 h1:KwYTR0Nsb/r1lr2sOKwSVX/lMytHU4WjlkDQ/AugHxg=