Who is this for?
This Learning Path is for developers familiar with CCA attestation and the Veraison project. You'll learn how to deploy a scalable CCA attestation verifier service on AWS.
What will you learn?
Upon completion of this Learning Path, you will be able to:
- Build an attestation service on AWS using the Veraison project's components.
- Set up Veraison as a verifier for Arm CCA attestation tokens by provisioning CCA platform endorsements.
Prerequisites
Before starting, you will need the following:
- An
AWS account
with access to AWS services.
- An x86 computer running Ubuntu or Arch Linux, authorized for AWS access. If you’re using another build environment, you’ll need to configure the toolchains for cross-compilation.
Summary
AI-assisted
This summary was drafted with an approved AI-assisted workflow and reviewed by Arm contributors before publication.
Human technical review remains part of the process so the final page reflects engineering rigor, accuracy, and Arm editorial standards.
You’ll deploy Veraison on AWS to serve as the Verifier in the RATS (RFC9334) model for Arm CCA attestation. After preparing an AWS account and authenticating, you’ll create a Route53 domain and an HTTPS certificate so the Veraison REST APIs can be published on the internet. You’ll deploy from the Veraison GitHub repository and use a bootstrap process to clone sources and set up the build environment. With the services running, you’ll provision CCA platform endorsements using the Linaro endorsement tool so Veraison can verify CCA attestation tokens.
Frequently asked questions
AI-assisted
These FAQs were drafted with an approved AI-assisted workflow and reviewed by Arm contributors before publication.
Human technical review remains part of the process so the final page reflects engineering rigor, accuracy, and Arm editorial standards.
Use an active AWS account with administrator-level privileges and install the AWS CLI. Set up authentication in your local environment following the AWS documentation before proceeding.
Why do I need a Route53 domain and a certificate for this deployment?The Veraison services are published on the internet and accessed over HTTPS using RESTful APIs. A Route53-managed domain and a valid certificate allow clients to reliably reach the services via DNS and establish secure connections.
How do I begin the automated Veraison deployment and how long will it take?Start with the Bootstrap process from the Veraison GitHub repository to clone the source and set up the build environment, which also installs required dependencies. The AWS resource creation typically takes 30 to 60 minutes.
Where do I get the tool to add CCA platform endorsements?Clone the Linaro endorsement tool from the Linaro Git server using: git clone https://git.codelinaro.org/linaro/dcap/cca-demos/poc-endorser. Configure the tool for AWS as described in the steps to provide the CCA platform endorsements to Veraison.
What indicates the verifier is ready to handle CCA tokens after deployment?After the Veraison services are running and CCA platform endorsements have been provisioned, the deployment is set up for CCA attestation verification. The services are exposed via HTTPS on your configured domain.