Development

pyproject.toml

python -m build --wheel bdist_wheel

Deployment

twine upload --verbose  -r testpypi dist/bdrc_db_lib-x.MM.mm-py3-none-any.whl

Implementation

The architecture lends itself to a Docker Secrets + KMS Decryption Scheme. The interested user can refer to Buda-base/ao-workflows

Steps (Thanks to Perplexity)

1. Encrypt password (One-Time, secure workstation)

# AWS KMS example (use AWS CLI)
aws kms encrypt \
--key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd \
--plaintext "mypassword123" \
--output text \
--query CiphertextBlob | base64 > encrypted_db_pass.b64

1. Docker Secret (Encrypted Blob)

   Add the encrypted blob into the docker image. “But wait,” I hear you say, won’t a hacker have access to the encrypted image?” “Yes, but only until the Docker container is started. The encrypted blob is removed at Docker startup. (See Step 3)

# docker-compose.yml
version: '3.8'
services:
app:
   image: myapp:latest
   secrets:
      - db_password
   environment:
      DB_PASSWORD_FILE: /run/secrets/db_password

secrets:
db_password:
   file: ./encrypted_db_pass.b64
   external: false  # Don't commit

1. Decrypt at Runtime (Entry script)

   This decrypts the password blob at runtime, and then removes the blob from the container’s file system The only hacker access would be if they could inspect the running container (or has injected code into some open source library that grants access to the Docker inspector)

#!/usr/bin/env python3
import boto3
import base64
import os
import sys

kms = boto3.client('kms')
encrypted_pass = base64.b64decode(open('/run/secrets/db_password').read())
decrypted_pass = kms.decrypt(CiphertextBlob=encrypted_pass)['Plaintext'].decode()

os.environ['DB_PASSWORD'] = decrypted_pass
os.unlink('/run/secrets/db_password')  # Wipe secret file

# Start app
exec(sys.argv[1])

Changelog