Neolithic Psychedelic Mushrooms

    secretsmanager-versioning
    TypeScript icon, indicating that this package has built-in type declarations

    0.0.13 • Public • Published

    SecretsManger Versioning

    A CLI Tool to manage and version AWS Secrets with SOPS

    Overview

    SecretsManager Version is a CLI Tool for Secrets in combination with SOPS. It helps you keep your secrets safe and versioned inside git projects. The SecretsManager is capable of storing up to 20 tagged secret versions which SecretsManger-Versioning will make use of. The secrets will be versioned by using the MD5 Hash of the encrypted file. With this, every change of the SOPS file will be tagged with a unique key to reference. On top of that, each tag is connected with a Git project and Commit Hash to trace its origin.

    Prerequisites

    Secret Management

    Create a new git repository and open a new terminal there:

    git init .
    git remote add origin git@github.com:username/new_repo

    Create a new sops file and encrypt it with your kms key:

    sops --kms arn:aws:kms:region:account:key/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx sops.json

    Now run the following to test if the configuration works:

    npx secretsmanager-versioning -f sops.json SecretName
    

    You should be able to verify that a secret under this name in the currently logged-in account and region was created for you. You can also create a secret yourself and simply reference it. You can verify this by checking the secret in your console or by executing:

    aws secretsmanager describe-secret --secret-id SecretName

    You should be able to verify that the secret is tagged with a md5 hash and the current version should reference your recent commit.

    Cross account access

    By providing the --role,-r option you can specify that a cross account role should be assumed before any AWS API call.

    npx secretsmanager-versioning -f sops.json -r arn:aws:iam::123456789012:role/MagicRole SecretName
    

    Usage

    The secret can be used by referring to with the md5 hash. There are multiple ways to do this. One example is highlighted here.

    Decrypted Sops File (sops.json)

    {
      "example": "supersecretstring"
    }

    CDK

    Add the md5-file dependency to your project and reference your sops file and Secret. After that you should be to reference a jsonField to get reference the secret value:

    import { sync as md5 } from "md5-file";
    const secretPath = "SecretName";
    const versionId = md5("sops.json");
    const secret = cdk.SecretValue.secretsManager(secretPath, {
      jsonField: "example",
      versionId: versionId,
    }).toString();
    console.log(secret); // {{resolve:secretsmanager:SecretName:SecretString:example::md5hashvalue}}
    CDK Pipeline - Automatic update of Secrets

    If you are using the CDK pipelines module, you can use the following CodeBuild-Step to automatically update your secret in the pipeline:

    const updateSecretEU = new pipelines.CodeBuildStep( 'updateSecret', {
      commands:[
        `npx secretsmanager-versioning -f ${secretFileName} '${secretName}'`,
      ],
      rolePolicyStatements: [
        new iam.PolicyStatement({
          actions: [
            "secretsmanager:UntagResource",
            "secretsmanager:DescribeSecret",
            "secretsmanager:PutSecretValue",
            "secretsmanager:UpdateSecretVersionStage",
            "secretsmanager:TagResource",
          ],
          resources: ['secretArn'],
        }),
        new iam.PolicyStatement({
          actions: [
            "kms:Decrypt",
            "kms:Encrypt",
            "kms:GenerateDataKey",
          ],
          resources: ['secretKeyArn'],
        }),
      ],
    });

    Then use this CodeBuildStep as a pre-action in your stage.

    Keywords

    none

    Install

    npm i secretsmanager-versioning

    DownloadsWeekly Downloads

    3

    Version

    0.0.13

    License

    Apache-2.0

    Unpacked Size

    432 kB

    Total Files

    35

    Last publish

    Collaborators

    • taimos-user