Documentation
¶
Index ¶
- Constants
- Variables
- func ComputeHmac256(message, secret []byte) []byte
- func Decode(data map[string]*dynamodb.AttributeValue, rawVal interface{}) error
- func Decrypt(key, ciphertext []byte) ([]byte, error)
- func DeleteSecret(tableName *string, name string) error
- func Encode(rawVal interface{}) (map[string]*dynamodb.AttributeValue, error)
- func Encrypt(key, plaintext []byte) ([]byte, error)
- func GetHighestVersion(tableName *string, name string) (string, error)
- func PaddedInt(i int) string
- func PutSecret(tableName *string, alias, name, secret, version string, ...) error
- func ResolveVersion(tableName *string, name string, version int) (string, error)
- func SetAwsConfig(region, profile *string, role *string) (err error)
- func SetDynamoDBConfig(config *aws.Config)
- func SetDynamoDBSession(sess *session.Session)
- func SetKMSConfig(config *aws.Config)
- func SetKMSSession(sess *session.Session)
- func Setup(tableName *string, read *int64, write *int64) (err error)
- type ByName
- type ByVersion
- type Credential
- type DataKey
- type DecryptedCredential
- func GetAllSecrets(tableName *string, allVersions bool, encContext *EncryptionContextValue) ([]*DecryptedCredential, error)
- func GetHighestVersionSecret(tableName *string, name string, encContext *EncryptionContextValue) (*DecryptedCredential, error)
- func GetSecret(tableName *string, name, version string, encContext *EncryptionContextValue) (*DecryptedCredential, error)
- type EncryptionContextValue
- type TableWriter
Constants ¶
const ( // TableFormatTerm format the table for a terminal session TableFormatTerm = iota // 0 // TableFormatCSV format the table as CSV TableFormatCSV // 1 )
const ( // DefaultKmsKey default KMS key alias name DefaultKmsKey = "alias/credstash" // CreatedAtNotAvailable returned to indicate the created at field is missing // from the secret/Name CreatedAtNotAvailable = "Not Available" )
const MaxPaddingLength = 19 // Number of digits in MaxInt64
Variables ¶
var ( // ErrSecretNotFound returned when unable to find the specified secret in dynamodb ErrSecretNotFound = errors.New("Secret Not Found") // ErrHmacValidationFailed returned when the hmac signature validation fails ErrHmacValidationFailed = errors.New("Secret HMAC validation failed") // ErrTimeout timeout occured waiting for dynamodb table to create ErrTimeout = errors.New("Timed out waiting for dynamodb table to become active") )
Functions ¶
func ComputeHmac256 ¶
ComputeHmac256 compute a hmac256 signature of the supplied message and return the value hex encoded
func Decode ¶
func Decode(data map[string]*dynamodb.AttributeValue, rawVal interface{}) error
Decode decode the supplied struct from the dynamodb result map
func Decrypt ¶
Decrypt AES encryption method which matches the pycrypto package using CTR and AES256. Note this routine seeds the counter/iv with a value of 1 then throws it away?!
func DeleteSecret ¶
DeleteSecret delete a secret
func Encode ¶
func Encode(rawVal interface{}) (map[string]*dynamodb.AttributeValue, error)
Encode return the value encoded as a map of dynamo attributes.
func Encrypt ¶
Encrypt AES encryption method which matches the pycrypto package using CTR and AES256. Note this routine seeds the counter/iv with a value of 1 then throws it away?!
func GetHighestVersion ¶ added in v1.1.0
GetHighestVersion look up the highest version for a given name
func PaddedInt ¶ added in v1.5.0
PaddedInt returns an integer left-padded with zeroes to the max-int length
func PutSecret ¶
func PutSecret(tableName *string, alias, name, secret, version string, encContext *EncryptionContextValue) error
PutSecret retrieve the secret from dynamodb
func ResolveVersion ¶ added in v1.1.0
ResolveVersion converts an integer version to a string, or if a version isn't provided (0), returns "1" if the secret doesn't exist or the latest version plus one (auto-increment) if it does.
func SetAwsConfig ¶ added in v1.4.0
SetAwsConfig configure the AWS region with a fallback for discovery on EC2 hosts.
func SetDynamoDBConfig ¶ added in v1.0.2
SetDynamoDBConfig override the default aws configuration
func SetDynamoDBSession ¶ added in v1.7.1
func SetKMSConfig ¶ added in v1.0.2
SetKMSConfig override the default aws configuration
func SetKMSSession ¶ added in v1.7.1
Types ¶
type Credential ¶
type Credential struct { Name string `dynamodbav:"name"` Version string `dynamodbav:"version"` Key string `dynamodbav:"key"` Contents string `dynamodbav:"contents"` Hmac []byte `dynamodbav:"hmac"` CreatedAt int64 `dynamodbav:"created_at"` }
Credential managed credential information
func ListSecrets ¶
func ListSecrets(tableName *string, allVersions bool) ([]*Credential, error)
ListSecrets returns a list of all secrets
func (*Credential) CreatedAtDate ¶ added in v1.0.3
func (c *Credential) CreatedAtDate() string
CreatedAtDate convert the timestamp field to a date string
type DataKey ¶
DataKey which contains the details of the KMS key
func DecryptDataKey ¶
func DecryptDataKey(ciphertext []byte, encContext *EncryptionContextValue) (*DataKey, error)
DecryptDataKey ask kms to decrypt the supplied data key
func GenerateDataKey ¶
func GenerateDataKey(alias string, encContext *EncryptionContextValue, size int) (*DataKey, error)
GenerateDataKey simplified method for generating a datakey with kms
type DecryptedCredential ¶
type DecryptedCredential struct { *Credential Secret string }
DecryptedCredential managed credential information
func GetAllSecrets ¶ added in v1.1.0
func GetAllSecrets(tableName *string, allVersions bool, encContext *EncryptionContextValue) ([]*DecryptedCredential, error)
GetAllSecrets returns a list of all secrets
func GetHighestVersionSecret ¶ added in v1.5.0
func GetHighestVersionSecret(tableName *string, name string, encContext *EncryptionContextValue) (*DecryptedCredential, error)
GetHighestVersionSecret retrieves latest secret from dynamodb using the name
func GetSecret ¶
func GetSecret(tableName *string, name, version string, encContext *EncryptionContextValue) (*DecryptedCredential, error)
GetSecret look up a secret by name and version
type EncryptionContextValue ¶ added in v1.4.0
EncryptionContextValue key value with helper methods for flag parser
func NewEncryptionContextValue ¶ added in v1.4.0
func NewEncryptionContextValue() *EncryptionContextValue
NewEncryptionContextValue create a new encryption context
func (*EncryptionContextValue) IsCumulative ¶ added in v1.4.0
func (h *EncryptionContextValue) IsCumulative() bool
IsCumulative flag this value as cumulative
func (*EncryptionContextValue) Set ¶ added in v1.4.0
func (h *EncryptionContextValue) Set(value string) error
Set converts a flag value into an encryption context key value
func (*EncryptionContextValue) String ¶ added in v1.4.0
func (h *EncryptionContextValue) String() string
type TableWriter ¶
type TableWriter struct {
// contains filtered or unexported fields
}
TableWriter enables writing of tables in a variety of formats
func (*TableWriter) BulkWrite ¶
func (tw *TableWriter) BulkWrite(rows [][]string)
BulkWrite append an array of rows to the buffer
func (*TableWriter) Render ¶
func (tw *TableWriter) Render() error
Render render the table out to the supplied writer
func (*TableWriter) SetFormat ¶
func (tw *TableWriter) SetFormat(tableFormat int)
SetFormat set the format
func (*TableWriter) SetHeaders ¶
func (tw *TableWriter) SetHeaders(headers []string)
SetHeaders set the column headers
func (*TableWriter) Write ¶
func (tw *TableWriter) Write(row []string)