Simple secrets management powered by Amazon S3 + KMS
Microsecrets is a secrets distribution tool powered by Amazon S3 and Amazon KMS. It provides a bare-bones approach to passing credentials securely in an Amazon Web Services environment. Credentials are uploaded to S3 and encrypted at rest by KMS. They can then be passed to programs through environment variables.
$ pip install microsecrets
Upload environment variable data. Environment variables may be passed as = separated pairs on stdin or in a file. NB: whitespace is stripped and all other characters are treated literally. Or pass them as a JSON dict with the --json flag.
$ microsecrets-upload -b example-microsecrets -s myservice <<EOM DB_URL=db://user:firstname.lastname@example.org:123 PASSWORD=hunter2 EOM
Upload a raw file. Usage is the same as uploading environment variables, but you pass a -f LABEL to determine where to upload the file. This example uploads a file from ~/documents/train.txt with label train.txt.
$ microsecrets-upload -b example-microsecrets -s myservice -f train.txt ~/documents/train.txt
TODO: flesh out this section
List latest versions of current files available for download
$ microsecrets-download -b example-microsecrets -s myservice --list
Download the environment
$ microsecrets-download -b example-microsecrets -s myservice
Download files with the environment
$ microsecrets-download -b example-microsecrets -s myservice -f train.txt:/tmp/train.txt
Run a program with the credentials in the environment. To verify the integrity of data in S3, you must specify the checksum of the environment file (output by the upload tool) or whitelist specific environment variables. Or, if integrity is not a concern, whitelist all environment variables. The whitelist is designed to avoid accidentally allowing code execution through LD_PRELOAD or similar, which may or may not be a concern in your system layout.
$ microsecrets-with-env -b example-microsecrets -s myservice -w 'DB_URL PASSWORD' -- /bin/myserver
There is a variety of other recent work in this space that may be of interest:
The project is in the public domain, and all contributions will also be released in the public domain. By submitting a pull request, you are agreeing to waive all rights to your contribution under the terms of the CC0 Public Domain Dedication.
This project constitutes an original work of the United States Government.