Do we need to generate Digital Certificates to sign Pdf from AEM using AWS KMS

[RamaniBa]

Do we need to generate Digital Certificates to sign Pdf from AEM using AWS KMS?  I need to sign the pdf digitally and there is no verification of the signature involved. Help me understanding this whole process

[Hemalatha]

Hi @RamaniBa ,

You might need to use a PDF library (e.g., Apache PDFBox) to sign the PDF using the key fetched from AWS KMS and a logic to verify the signature in AEM.

Apache PDFBox | A Java PDF Library

Also make sure proper IAM policies are set on AWS and a service user with necessary permission is created on AEM to achieve the requirement.

Hope this helps.

Regards,

Hemalatha C

[RamaniBa]

OKay will look at this. I am looking at using AEM SignatureService Java code on AEM website and KMS. 

[RB0007]

Hi Hemalatha,

I saw your response and have got the following questions:

Our Goal - To Sign Documents with AWS KMS KEY, get the following:

1. Adobe Approved Trusted Layer Stamp 
2. Signatures are valid

My Questions

• We want to use AWS KMS key to sign documents which doesn't require Cloud HSM environment. Consequently, we don't have to provision the IAM.
• The AE article, https://experienceleague.adobe.com/en/docs/experience-platform/landing/governance-privacy-security/c... doesn't specify on how to use KMS key with AE.
• This article is also dependent on IAM policy which is not required to set up IAM when using KMS Cloud Keys:https://experienceleague.adobe.com/en/docs/experience-platform/landing/governance-privacy-security/c...
• How to configure the enviornment so that we can delpoy the techniques?

Will appreciate your prompt response.

Thanks & Regards,

RB