awskms

Documentation

Index

• type CredsProvider
  • func LoadCredsProviderFromYaml(b []byte) (*CredsProvider, error)
  • func NewCredsProvider(cp aws.CredentialsProvider) *CredsProvider
  • func (c CredsProvider) ApplyToMasterKey(key *MasterKey)
• type MasterKey
  • func NewMasterKey(arn string, role string, context map[string]string) *MasterKey
  • func NewMasterKeyFromArn(arn string, context map[string]string, awsProfile string) *MasterKey
  • func (key *MasterKey) Decrypt() ([]byte, error)
  • func (key *MasterKey) Encrypt(dataKey []byte) error
  • func (key *MasterKey) EncryptIfNeeded(dataKey []byte) error
  • func (key *MasterKey) EncryptedDataKey() []byte
  • func (key *MasterKey) NeedsRotation() bool
  • func (key *MasterKey) SetEncryptedDataKey(enc []byte)
  • func (key MasterKey) ToMap() map[string]interface{}
  • func (key *MasterKey) ToString() string

Types

type CredsProvider

type CredsProvider struct {
	// contains filtered or unexported fields
}

CredsProvider is a wrapper around aws.CredentialsProvider used for authenticating towards AWS KMS.

func LoadCredsProviderFromYaml

func LoadCredsProviderFromYaml(b []byte) (*CredsProvider, error)

LoadCredsProviderFromYaml parses the given YAML returns a CredsProvider object which contains the credentials provider used for authenticating towards AWS KMS.

func NewCredsProvider

func NewCredsProvider(cp aws.CredentialsProvider) *CredsProvider

NewCredsProvider returns a CredsProvider object with the provided aws.CredentialsProvider.

func (CredsProvider) ApplyToMasterKey

func (c CredsProvider) ApplyToMasterKey(key *MasterKey)

ApplyToMasterKey configures the credentials the provided key.

type MasterKey

type MasterKey struct {
	// AWS Role ARN associated with the KMS key.
	Arn string
	// AWS Role ARN used to assume a role through AWS STS.
	Role string
	// EncryptedKey stores the data key in it's encrypted form.
	EncryptedKey string
	// CreationDate is when this MasterKey was created.
	CreationDate time.Time
	// EncryptionContext provides additional context about the data key.
	// Ref: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
	EncryptionContext map[string]string
	// AWSProfile is the profile to use for loading configuration and credentials.
	AwsProfile string
	// contains filtered or unexported fields
}

MasterKey is an AWS KMS key used to encrypt and decrypt sops' data key. Adapted from: https://github.com/mozilla/sops/blob/v3.7.2/kms/keysource.go#L39 Modified to accept custom static credentials as opposed to using env vars by default and use aws-sdk-go-v2 instead of aws-sdk-go being used in upstream.

func NewMasterKey

func NewMasterKey(arn string, role string, context map[string]string) *MasterKey

NewMasterKey creates a new MasterKey from an ARN, role and context, setting the creation date to the current date.

func NewMasterKeyFromArn

func NewMasterKeyFromArn(arn string, context map[string]string, awsProfile string) *MasterKey

NewMasterKeyFromArn takes an ARN string and returns a new MasterKey for that ARN.

func (*MasterKey) Decrypt

func (key *MasterKey) Decrypt() ([]byte, error)

Decrypt decrypts the EncryptedKey field with AWS KMS and returns the result.

func (*MasterKey) Encrypt

func (key *MasterKey) Encrypt(dataKey []byte) error

Encrypt takes a SOPS data key, encrypts it with KMS and stores the result in the EncryptedKey field.

func (*MasterKey) EncryptIfNeeded

func (key *MasterKey) EncryptIfNeeded(dataKey []byte) error

EncryptIfNeeded encrypts the provided sops' data key and encrypts it, if it has not been encrypted yet.

func (*MasterKey) EncryptedDataKey

func (key *MasterKey) EncryptedDataKey() []byte

EncryptedDataKey returns the encrypted data key this master key holds.

func (*MasterKey) NeedsRotation

func (key *MasterKey) NeedsRotation() bool

NeedsRotation returns whether the data key needs to be rotated or not.

func (*MasterKey) SetEncryptedDataKey

func (key *MasterKey) SetEncryptedDataKey(enc []byte)

SetEncryptedDataKey sets the encrypted data key for this master key.

func (MasterKey) ToMap

func (key MasterKey) ToMap() map[string]interface{}

ToMap converts the MasterKey to a map for serialization purposes.

func (*MasterKey) ToString

func (key *MasterKey) ToString() string

ToString converts the key to a string representation.