Skip to main content

Humilis plug-in to deploy a Lambda humilis_decrypt

Project description


A humilis plug-in layer that deploys a custom Cloudformation (CF) resource that can be used to decrypt secrets that are embedded in CF templates.

CREDIT: All credit goes to Casecommons lambda-cfn-kms. This repo is just the result of bundling the lambda-cfn-kms repository as a humilis plugin.


pip install humilis-decrypt

To install the development version:

pip install git+


Assuming you have virtualenv installed:

make develop

Configure humilis:

make configure

How does it work?

First create the Lambda function that backs the custom resource:

make create

The deployment will produce two artifacts:

  • The ID of the KMS key associated with the custom resource.

  • The ARN of the deployed Lambda function.

You can use the KMS key ID to encrypt your secrets locally, e.g. assuming you want to encrypt the dummy DB password dummy with key 3ea941bf-ee54-4941-8f77-f1dd417667cd:

aws kms encrypt --key-id 3ea941bf-ee54-4941-8f77-f1dd417667cd --plaintext 'dummy'

The output will be something like this:

    "CiphertextBlob": "AQICAHi2zdvZYfUQOQV8yX/HLdcIMqHHkubAYAei2Qo498KheQFDELPYHds8169cc9EqggEuAAAAZjBkBgkqhkiG9w0BBwagVzBVAgEAMFAGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM+gDfP3DDVgbFYNidAgEQgCMrz1beR+s0XqWTVIuCbJ+E/cC7sqUzmPEB0weOhQ3GOE65rg==",
    "KeyId": "arn:aws:kms:eu-west-1:XXXXX:key/a86x4dd8-6b8e-41ce-aa65-4aa370d9ccbf"

Whenever you want to use your secret in a CF template you would do something like this:

    Type: "Custom::KMSDecrypt"
      ServiceToken: <lambda_function_arn>
      Ciphertext: "AQICAHi2zdvZYfUQOQV8yX/HLdcIMqHHkubAYAei2Qo498KheQFDELPYHds8169cc9EqggEuAAAAZjBkBgkqhkiG9w0BBwagVzBVAgEAMFAGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM+gDfP3DDVgbFYNidAgEQgCMrz1beR+s0XqWTVIuCbJ+E/cC7sqUzmPEB0weOhQ3GOE65rg=="
    Type: "AWS::RDS::DBInstance"
      AllocatedStorage: "20"
      DBInstanceClass: "db.m1.small"
      Engine: "MySQL"
      EngineVersion: "5.5"
      MasterUsername: "admin"
        Fn::Sub: ${DbPasswordDecrypt.Plaintext}

where you will need to replace <lambda_function_arn> with the ARN of the Lambda function that backs the custom CF resource that implements the decryption logic.

More information

See humilis documentation.


If you have questions, bug reports, suggestions, etc. please create an issue on the GitHub project page.


See the original license in the lambda-cfn-kms repository.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

humilis-decrypt-0.0.2.tar.gz (5.4 kB view hashes)

Uploaded Source

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page