簽署者範例使用 AWS CLI - AWS Command Line Interface

本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。

簽署者範例使用 AWS CLI

下列程式碼範例說明如何使用 AWS Command Line Interface 搭配 Signer 來執行動作及實作常見案例。

Actions 是大型程式的程式碼摘錄,必須在內容中執行。雖然動作會告訴您如何呼叫個別服務函數,但您可以在其相關情境和跨服務範例中查看內容中的動作。

Scenarios (案例) 是向您展示如何呼叫相同服務中的多個函數來完成特定任務的程式碼範例。

每個範例都包含一個連結 GitHub,您可以在其中找到如何在內容中設定和執行程式碼的指示。

主題

動作

下列程式碼範例會示範如何使用cancel-signing-profile

AWS CLI

若要刪除簽署設定檔

下列cancel-signing-profile範例會從 AWS 簽署者移除現有的簽署設定檔。

aws signer cancel-signing-profile \ --profile-name MyProfile1

此命令不會產生輸出。

下列程式碼範例會示範如何使用describe-signing-job

AWS CLI

若要顯示簽署工作的詳細資料

下列describe-signing-job範例會顯示有關指定簽署工作的詳細資料。

aws signer describe-signing-job \ --job-id 2065c468-73e2-4385-a6c9-0123456789abc

輸出:

{ "status": "Succeeded", "completedAt": 1568412037, "platformId": "AmazonFreeRTOS-Default", "signingMaterial": { "certificateArn": "arn:aws:acm:us-west-2:123456789012:certificate/6a55389b-306b-4e8c-a95c-0123456789abc" }, "statusReason": "Signing Succeeded", "jobId": "2065c468-73e2-4385-a6c9-0123456789abc", "source": { "s3": { "version": "PNyFaUTgsQh5ZdMCcoCe6pT1gOpgB_M4", "bucketName": "signer-source", "key": "MyCode.rb" } }, "profileName": "MyProfile2", "signedObject": { "s3": { "bucketName": "signer-destination", "key": "signed-2065c468-73e2-4385-a6c9-0123456789abc" } }, "requestedBy": "arn:aws:iam::123456789012:user/maria", "createdAt": 1568412036 }

下列程式碼範例會示範如何使用get-signing-platform

AWS CLI

顯示簽署平台的詳細資料

下列get-signing-platform範例會顯示有關指定簽署平台的詳細資料。

aws signer get-signing-platform \ --platform-id AmazonFreeRTOS-TI-CC3220SF

輸出:

{ "category": "AWS", "displayName": "Amazon FreeRTOS SHA1-RSA CC3220SF-Format", "target": "SHA1-RSA-TISHA1", "platformId": "AmazonFreeRTOS-TI-CC3220SF", "signingConfiguration": { "encryptionAlgorithmOptions": { "defaultValue": "RSA", "allowedValues": [ "RSA" ] }, "hashAlgorithmOptions": { "defaultValue": "SHA1", "allowedValues": [ "SHA1" ] } }, "maxSizeInMB": 16, "partner": "AmazonFreeRTOS", "signingImageFormat": { "defaultFormat": "JSONEmbedded", "supportedFormats": [ "JSONEmbedded" ] } }

下列程式碼範例會示範如何使用get-signing-profile

AWS CLI

顯示簽署設定檔的詳細資料

下列get-signing-profile範例會顯示有關指定簽署設定檔的詳細資料。

aws signer get-signing-profile \ --profile-name MyProfile3

輸出:

{ "platformId": "AmazonFreeRTOS-TI-CC3220SF", "profileName": "MyProfile3", "status": "Active", "signingMaterial": { "certificateArn": "arn:aws:acm:us-west-2:123456789012:certificate/6a55389b-306b-4e8c-a95c-0123456789abc" } }

下列程式碼範例會示範如何使用list-signing-jobs

AWS CLI

列出所有簽署工作

下列list-signing-jobs範例會顯示有關帳戶所有簽署工作的詳細資料。

aws signer list-signing-jobs

在此範例中,傳回兩個工作,一個成功,一個失敗。

{ "jobs": [ { "status": "Succeeded", "signingMaterial": { "certificateArn": "arn:aws:acm:us-west-2:123456789012:certificate/6a55389b-306b-4e8c-a95c-0123456789abc" }, "jobId": "2065c468-73e2-4385-a6c9-0123456789abc", "source": { "s3": { "version": "PNyFaUTgsQh5ZdMCcoCe6pT1gOpgB_M4", "bucketName": "signer-source", "key": "MyCode.rb" } }, "signedObject": { "s3": { "bucketName": "signer-destination", "key": "signed-2065c468-73e2-4385-a6c9-0123456789abc" } }, "createdAt": 1568412036 }, { "status": "Failed", "source": { "s3": { "version": "PNyFaUTgsQh5ZdMCcoCe6pT1gOpgB_M4", "bucketName": "signer-source", "key": "MyOtherCode.rb" } }, "signingMaterial": { "certificateArn": "arn:aws:acm:us-west-2:123456789012:certificate/6a55389b-306b-4e8c-a95c-0123456789abc" }, "createdAt": 1568402690, "jobId": "74d9825e-22fc-4a0d-b962-0123456789abc" } ] }
  • 如需 API 詳細資訊,請參閱AWS CLI 命令參考ListSigningJobs中的。

下列程式碼範例會示範如何使用list-signing-platforms

AWS CLI

列出所有簽署平台

下列list-signing-platforms範例會顯示所有可用簽署平台的詳細資料。

aws signer list-signing-platforms

輸出:

{ "platforms": [ { "category": "AWS", "displayName": "AWS IoT Device Management SHA256-ECDSA ", "target": "SHA256-ECDSA", "platformId": "AWSIoTDeviceManagement-SHA256-ECDSA", "signingConfiguration": { "encryptionAlgorithmOptions": { "defaultValue": "ECDSA", "allowedValues": [ "ECDSA" ] }, "hashAlgorithmOptions": { "defaultValue": "SHA256", "allowedValues": [ "SHA256" ] } }, "maxSizeInMB": 2048, "partner": "AWSIoTDeviceManagement", "signingImageFormat": { "defaultFormat": "JSONDetached", "supportedFormats": [ "JSONDetached" ] } }, { "category": "AWS", "displayName": "Amazon FreeRTOS SHA1-RSA CC3220SF-Format", "target": "SHA1-RSA-TISHA1", "platformId": "AmazonFreeRTOS-TI-CC3220SF", "signingConfiguration": { "encryptionAlgorithmOptions": { "defaultValue": "RSA", "allowedValues": [ "RSA" ] }, "hashAlgorithmOptions": { "defaultValue": "SHA1", "allowedValues": [ "SHA1" ] } }, "maxSizeInMB": 16, "partner": "AmazonFreeRTOS", "signingImageFormat": { "defaultFormat": "JSONEmbedded", "supportedFormats": [ "JSONEmbedded" ] } }, { "category": "AWS", "displayName": "Amazon FreeRTOS SHA256-ECDSA", "target": "SHA256-ECDSA", "platformId": "AmazonFreeRTOS-Default", "signingConfiguration": { "encryptionAlgorithmOptions": { "defaultValue": "ECDSA", "allowedValues": [ "ECDSA" ] }, "hashAlgorithmOptions": { "defaultValue": "SHA256", "allowedValues": [ "SHA256" ] } }, "maxSizeInMB": 16, "partner": "AmazonFreeRTOS", "signingImageFormat": { "defaultFormat": "JSONEmbedded", "supportedFormats": [ "JSONEmbedded" ] } } ] }

下列程式碼範例會示範如何使用list-signing-profiles

AWS CLI

列出所有簽署設定檔

下列list-signing-profiles範例會顯示有關帳戶所有簽署設定檔的詳細資料。

aws signer list-signing-profiles

輸出:

{ "profiles": [ { "platformId": "AmazonFreeRTOS-TI-CC3220SF", "profileName": "MyProfile4", "status": "Active", "signingMaterial": { "certificateArn": "arn:aws:acm:us-west-2:123456789012:certificate/6a55389b-306b-4e8c-a95c-0123456789abc" } }, { "platformId": "AWSIoTDeviceManagement-SHA256-ECDSA", "profileName": "MyProfile5", "status": "Active", "signingMaterial": { "certificateArn": "arn:aws:acm:us-west-2:123456789012:certificate/6a55389b-306b-4e8c-a95c-0123456789abc" } } ] }

下列程式碼範例會示範如何使用put-signing-profile

AWS CLI

若要建立簽署設定檔

下列put-signing-profile範例會使用指定的憑證和平台建立簽署設定檔。

aws signer put-signing-profile \ --profile-name MyProfile6 \ --signing-material certificateArn=arn:aws:acm:us-west-2:123456789012:certificate/6a55389b-306b-4e8c-a95c-0123456789abc \ --platform AmazonFreeRTOS-TI-CC3220SF

輸出:

{ "arn": "arn:aws:signer:us-west-2:123456789012:/signing-profiles/MyProfile6" }

下列程式碼範例會示範如何使用start-signing-job

AWS CLI

若要開始簽署工作

下列start-signing-job範例會針對在指定來源找到的程式碼啟動簽署工作。它使用指定的配置文件進行簽名,並將簽名的代碼放在指定的目的地。

aws signer start-signing-job \ --source 's3={bucketName=signer-source,key=MyCode.rb,version=PNyFaUTgsQh5ZdMCcoCe6pT1gOpgB_M4}' \ --destination 's3={bucketName=signer-destination,prefix=signed-}' \ --profile-name MyProfile7

輸出是簽署工作的 ID。

{ "jobId": "2065c468-73e2-4385-a6c9-0123456789abc" }
  • 如需 API 詳細資訊,請參閱AWS CLI 命令參考StartSigningJob中的。