Skip to main content

Humilis layer that deploys a secrets vault

Project description

Build Status PyPI

A humilis plugin that implements a secrets-vault layer. The layer consists of an encrypted DynamoDB table that serves secrets to Lambda functions in the same humilis environment. The encryption and decryption of secrets is handled by AWS KMS service.


From PyPI:

pip install humilis-secrets-vault

To install the dev version:

pip install git+

How do I use this?

Simply add this layer to your humilis environment and use the layer parameter associated_processors to specify the layers that contain the Lambda functions that require access to the secrets in the vault. For example, the environment below deploys a Lambda function that processes events in a Kinesis stream. The Lambda processor is granted access to the secrets vault that is also part of the same environment:

        An environment with a Lambda processor to filter events in a Kinesis

        - layer: streams
          layer_type: streams
              - name: InputStream
                shard_count: 1

        - layer: event-processor
          layer_type: kinesis-processor
          dependencies: ["streams"]
          input: {layer: streams, stream: InputStream}

        - layer: secrets-vault
          layer_type: secrets-vault
          # We specify that the Lambda function in the event-processor layer
          # should have access to the secrets in the vault.
          associated_processors: ["event-processor"]

The secrets-vault layer expects that the layer(s) that contain the Lambda processor(s) expose a layer output LambdaFunctionArn with the ARN of the Lambda function that should have access to the secrets in the vault. Layers of type kinesis-processor as in the example above fulfil this expectation so they will work out-of-the-box.

Retrieving secrets

The easiest way of retrieving secrets from your Lambda function is to include package lambdautils as a depencency.

Then you can easily retrieve secrets from the vault within your Lambda code as follows:

import lambdautils.utils as utils

# Assuming that you are deploying this Lambda with humilis the line below
# will indicate humilis to preprocess this function with Jinja2 before
# producing the Lambda deployment package.
# preprocessor:jinja2

# During deployment, humilis will replace here the name of the humilis
# environment and deployment stage.
STAGE = "{{_env.stage}}"

plaintext = utils.get_secret(
    "my_secret_key", environment=ENVIRONMENT, stage=STAGE)

Storing secrets

You can use humilis to store secrets in the vault from the command line:

humilis set-secret --stage [STAGE] [ENVIRONMENT_FILE] [SECRET_KEY] [SECRET_VALUE]


Assuming you have virtualenv installed:

make develop

Configure humilis:

.env/bin/humilis configure --local


You can test the deployment of the secrets vault using:

make create

Then you can then run the integration test suite (TBD):

make testi

Don’t forget to delete the test deployment once you are done:

make delete

More information

See humilis documentation.


If you have questions, bug reports, suggestions, etc. please create an issue on the GitHub project page.


This software is licensed under the MIT license.

See License file.

© 2016 German Gomez-Herrero, Find Hotel and others.

Project details

Release history Release notifications

This version
History Node


History Node


History Node


History Node


History Node


History Node


History Node


History Node


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
humilis-secrets-vault-0.2.4.tar.gz (4.7 kB) Copy SHA256 hash SHA256 Source None Jul 3, 2016

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging CloudAMQP CloudAMQP RabbitMQ AWS AWS Cloud computing Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page