Skip to main content
Join the official 2019 Python Developers SurveyStart the survey!

Humilis plug-in to deploy a Lambda humilis_decrypt

Project description

PyPI

A humilis plug-in layer that deploys a custom Cloudformation (CF) resource that can be used to decrypt secrets that are embedded in CF templates.

CREDIT: All credit goes to Casecommons lambda-cfn-kms. This repo is just the result of bundling the lambda-cfn-kms repository as a humilis plugin.

Installation

pip install humilis-decrypt

To install the development version:

pip install git+https://github.com/humilis/humilis-decrypt

Development

Assuming you have virtualenv installed:

make develop

Configure humilis:

make configure

How does it work?

First create the Lambda function that backs the custom resource:

make create

The deployment will produce two artifacts:

  • The ID of the KMS key associated with the custom resource.
  • The ARN of the deployed Lambda function.

You can use the KMS key ID to encrypt your secrets locally, e.g. assuming you want to encrypt the dummy DB password dummy with key 3ea941bf-ee54-4941-8f77-f1dd417667cd:

aws kms encrypt --key-id 3ea941bf-ee54-4941-8f77-f1dd417667cd --plaintext 'dummy'

The output will be something like this:

{
    "CiphertextBlob": "AQICAHi2zdvZYfUQOQV8yX/HLdcIMqHHkubAYAei2Qo498KheQFDELPYHds8169cc9EqggEuAAAAZjBkBgkqhkiG9w0BBwagVzBVAgEAMFAGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM+gDfP3DDVgbFYNidAgEQgCMrz1beR+s0XqWTVIuCbJ+E/cC7sqUzmPEB0weOhQ3GOE65rg==",
    "KeyId": "arn:aws:kms:eu-west-1:XXXXX:key/a86x4dd8-6b8e-41ce-aa65-4aa370d9ccbf"
}

Whenever you want to use your secret in a CF template you would do something like this:

---
resources:
  DbPasswordDecrypt:
    Type: "Custom::KMSDecrypt"
    Properties:
      ServiceToken: <lambda_function_arn>
      Ciphertext: "AQICAHi2zdvZYfUQOQV8yX/HLdcIMqHHkubAYAei2Qo498KheQFDELPYHds8169cc9EqggEuAAAAZjBkBgkqhkiG9w0BBwagVzBVAgEAMFAGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM+gDfP3DDVgbFYNidAgEQgCMrz1beR+s0XqWTVIuCbJ+E/cC7sqUzmPEB0weOhQ3GOE65rg=="
  DbInstance:
    Type: "AWS::RDS::DBInstance"
    Properties:
      AllocatedStorage: "20"
      DBInstanceClass: "db.m1.small"
      Engine: "MySQL"
      EngineVersion: "5.5"
      MasterUsername: "admin"
      MasterUserPassword:
        Fn::Sub: ${DbPasswordDecrypt.Plaintext}

where you will need to replace <lambda_function_arn> with the ARN of the Lambda function that backs the custom CF resource that implements the decryption logic.

More information

See humilis documentation.

Contact

If you have questions, bug reports, suggestions, etc. please create an issue on the GitHub project page.

License

See the original license in the lambda-cfn-kms repository.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for humilis-decrypt, version 0.0.2
Filename, size File type Python version Upload date Hashes
Filename, size humilis-decrypt-0.0.2.tar.gz (5.4 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page