Skip to main content

Simple secrets management powered by Amazon S3 + KMS

Project description

https://img.shields.io/pypi/v/microsecrets.svg

Microsecrets is a secrets distribution tool powered by Amazon S3 and Amazon KMS. It provides a bare-bones approach to passing credentials securely in an Amazon Web Services environment. Credentials are uploaded to S3 and encrypted at rest by KMS. They can then be passed to programs through environment variables.

Installation

$ pip install microsecrets

Usage

Setup

  1. Create the S3 bucket you’ll use for secrets storage. You may want one bucket per organization, such as example.com-microsecrets.

  2. Create one KMS master key for each service that will be using microsecrets. The key should by default be named microsecrets-myservice for a service called myservice. Users uploading the credentials and systems downloading the credentials will need privileges to encrypt/decrypt data using this key. None of the normal users need key administration privileges.

Uploading environment and files

  1. Upload environment variable data. Environment variables may be passed as = separated pairs on stdin or in a file. NB: whitespace is stripped and all other characters are treated literally. Or pass them as a JSON dict with the --json flag.

    $ microsecrets-upload -b example-microsecrets -s myservice <<EOM
    DB_URL=db://user:pass@example.com:123
    PASSWORD=hunter2
    EOM
  2. Upload a raw file. Usage is the same as uploading environment variables, but you pass a -f LABEL to determine where to upload the file. This example uploads a file from ~/documents/train.txt with label train.txt.

    $ microsecrets-upload -b example-microsecrets -s myservice -f train.txt ~/documents/train.txt

Downloading files to show status

TODO: flesh out this section

  1. List latest versions of current files available for download

    $ microsecrets-download -b example-microsecrets -s myservice --list
  2. Download the environment

    $ microsecrets-download -b example-microsecrets -s myservice
  3. Download files with the environment

    $ microsecrets-download -b example-microsecrets -s myservice -f train.txt:/tmp/train.txt

Running programs under environment with secrets

  1. Run a program with the credentials in the environment. To verify the integrity of data in S3, you must specify the checksum of the environment file (output by the upload tool) or whitelist specific environment variables. Or, if integrity is not a concern, whitelist all environment variables. The whitelist is designed to avoid accidentally allowing code execution through LD_PRELOAD or similar, which may or may not be a concern in your system layout.

    $ microsecrets-with-env -b example-microsecrets -s myservice -w 'DB_URL PASSWORD' -- /bin/myserver

See also

There is a variety of other recent work in this space that may be of interest:

License

The project is in the public domain, and all contributions will also be released in the public domain. By submitting a pull request, you are agreeing to waive all rights to your contribution under the terms of the CC0 Public Domain Dedication.

This project constitutes an original work of the United States Government.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

microsecrets-0.3.4.tar.gz (12.7 kB view details)

Uploaded Source

File details

Details for the file microsecrets-0.3.4.tar.gz.

File metadata

  • Download URL: microsecrets-0.3.4.tar.gz
  • Upload date:
  • Size: 12.7 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No

File hashes

Hashes for microsecrets-0.3.4.tar.gz
Algorithm Hash digest
SHA256 146767a6986c7b809db0e51bd7ca29c86b0347e9bdb4280cfb70e89913ce7cb1
MD5 7214560ba023e471385d8eb33d4d0058
BLAKE2b-256 2ae7555872529754e3dc2e2a834c034c957804d037664cfbdbfeca175c9b813f

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page