5.3. Configuring a RHEL instance from a custom RHEL image with Secure Boot

Procedure

1. Generate a custom certificate custom_db.cer:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout custom_db.key \
   -new -x509 -sha256 \
   -days 3650 -subj "/CN=Signature Database key/" \
   --outform DER -out custom_db.cer

2. Use the virt-fw-vars utility to generate the aws_blob.bin binary file from keys, database certificates, and the UEFI variable store:

   $ virt-fw-vars --enroll-redhat \
   --add-db-cert OvmfEnrollDefaultKeys custom_db.cer \
   --set-dbx /usr/share/edk2/ovmf/DBX* \
   --output-aws aws_blob.bin

   The customized blob consists of:

   • Public Key (PK.cer), Key Exchange Key (KEK.cer), allowed signature database (db), and forbidden signature database (dbx) from the edk2-ovmf package
   • custom_db.cer the generated certificate

3. Use the awscli2 utility to create and register the AMI from a disk snapshot with the required Secure Boot variables:

   $ aws ec2 register-image \
   --name rhel-10.0-secure-boot \
   --architecture x86_64 \
   --virtualization-type hvm \
   --root-device-name "/dev/sda1" \
   --block-device-mappings "{\"DeviceName\": \"/dev/sda1\",\"Ebs\": {\"SnapshotId\": \"<snap-02d4db3813ff9b98e>\"}}" \
   --ena-support --boot-mode uefi \
   --region eu-central-1 \
   --uefi-data $(cat aws_blob.bin)
   --output json

   {
       "ImageId": "example-ami-id"
   }

4. Reboot the instance from the AWS Console.