Skip to main content
Join the official 2019 Python Developers SurveyStart the survey!

Django secrets management tool using AWS Secrets Manager

Project description

Django AWS SecretsManager

Django AWS SecretsManager is a package that helps you manage the secret values used by Django through AWS's SecretsManager service.

Requirements

  • Python >= 3.6
  • Django

Required settings for the settings module

  • AWS_SECRETS_MANAGER_SECRETS_NAME (or AWS_SECRETS_NAME)
    • Secret name of SecretsManager to use
  • AWS_SECRETS_MANAGER_SECRETS_SECTION (or AWS_SECRETS_SECTION)
    • The key that separates JSON objects by colons.
      ex) In the example below, the "production" item is represented as "sample-project:production".
  • AWS_SECRETS_MANAGER_REGION_NAME (or AWS_REGION_NAME)
    • Region of the SecretsManager service to use
      ex) ap-northeast-2

Secret value setting of AWS SecretsManager

SecretsManager's Secret value uses JSON format in Plaintext.
Here is an example Secret value to use for configuration, and the Secret (Corresponds to AWS_SECRETS_MANAGER_SECRETS_NAME in the settings module) is named sample-project-secret

{
  "sample-project(Recommend the name of django project)": {
    "base(If the settings module is a package, submodule names are recommended)": {
      "SECRET_KEY": "DjangoSecretKey"
    },
    "dev": {
      "AWS_S3_BUCKET_NAME": "sample-s3-dev"
    },
    "production": {
      "AWS_S3_BUCKET_NAME": "sample-s3-production"
    }
  }
}

Setting up AWS Credentials for Django to use

Django uses two methods to access the SecretsManager on AWS. The first uses a profile of ~/.aws/credentials in your home folder, and the second uses an environment variable.

1. Using the AWS Credentials Profile

Recommended for use in development environments

Set Profile of IAM User with SecretsManagerReadWrite Permission to ~/.aws/credentials. The following example uses the profile name sample-project-secretsmanager

[sample-project-secretsmanager]
aws_access_key_id = AKI*************
aws_secret_access_key = Mlp********************

Then enter the profile name in AWS_SECRETS_MANAGER_PROFILE (or AWS_PROFILE) of the settings module.

# settings.py
AWS_SECRETS_MANAGER_PROFILE = 'sample-project-secrets-manager'

2. Use environment variables

It is recommended to use in distribution or CI / CD environment.

If you set the following values in the environment variable, the contents are used to use the SecretsManager service.

  • AWS_SECRETS_MANAGER_ACCESS_KEY_ID (or AWS_ACCESS_KEY_ID)
  • AWS_SECRETS_MANAGER_SECRET_ACCESS_KEY (or AWS_SECRET_ACCESS_KEY)

Using Secrets in Django's Settings Module

  1. First, import the SECRETS instance of the library.
  2. Enter the settings for Django AWS SecretsManager
  3. Use SECRETS as a dictionary to get the secrets you want

Follow the form of the example below

By separating the settings module into packages, it is assumed that there are base and dev submodules.

settings/
    __init__.py
    base.py
    dev.py
## settings/base.py

# 1. Import the SECRETS instance of the library
from aws_secrets import SECRETS

# 2. Enter the settings for Django AWS SecretsManager
AWS_SECRETS_MANAGER_SECRETS_NAME = 'sample-project-secret'
AWS_SECRETS_MANAGER_PROFILE = 'sample-project-secretsmanager'
AWS_SECRETS_MANAGER_SECRETS_SECTION = 'sample-project:base'
AWS_SECRETS_MANAGER_REGION_NAME = 'ap-northeast-2'

# 3. Use SECRETS as a dictionary to get the secrets you want
SECRET_KEY = SECRETS['SECRET_KEY']
SECRET_KEY = SECRETS.get('SECRET_KEY')
## settings/dev.py

# The SECRETS instance is already imported from the base module.
from .base import *

# Use a different secrets section
AWS_SECRETS_MANAGER_SECRETS_SECTION = 'sample-project:dev'

# Use SECRETS as a dictionary to get the secrets you want
AWS_STORAGE_BUCKET_NAME = SECRETS['AWS_STORAGE_BUCKET_NAME']
AWS_STORAGE_BUCKET_NAME = SECRETS.get('AWS_STORAGE_BUCKET_NAME', 'default')

Contributing

As an open source project, we welcome contributions.
The code lives on GitHub

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for django-aws-secrets-manager, version 0.1.5
Filename, size File type Python version Upload date Hashes
Filename, size django_aws_secrets_manager-0.1.5-py3-none-any.whl (5.7 kB) File type Wheel Python version py3 Upload date Hashes View hashes
Filename, size django-aws-secrets-manager-0.1.5.tar.gz (4.6 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page