Skip to main content

encryption primitives for use with aws

Project description

murmuration

Build Status encryption primitives for use with aws kms

aes + galois counter mode encryption

from murmuration import gcm
key = 'this is my secret encryption key'
plaintext = 'the quick brown fox jumps over the lazy dog'
ciphertext = gcm.encrypt(plaintext, key, 'header')
decrypted = gcm.decrypt(ciphertext, key)
assert decrypted == plaintext

encryption using kms (for use with aws)

You can also use kms as an encryption / decryption service. This does incur kms costs and require kms setup. The region and profile parameters do not have to be specified. If they are not specified, the values will be inferred in the order specified by boto3:

  1. Passing credentials as parameters in the boto.client() method
  2. Passing credentials as parameters when creating a Session object
  3. Environment variables
  4. Shared credential file (~/.aws/credentials)
  5. AWS config file (~/.aws/config)
  6. Assume Role provider
  7. Boto2 config file (/etc/boto.cfg and ~/.boto)
  8. Instance metadata service on an Amazon EC2 instance that has an IAM role configured.
from murmuration import kms
plaintext = 'the quick brown fox jumps over the lazy dog'
key_alias = 'my kms key alias'
ciphertext = kms.encrypt(plaintext, key_alias, region='us-west-1', profile='company')
decrypted = kms.decrypt(ciphertext, region='us-west-1', profile='company')
assert decrypted == plaintext

wrapped encryption using kms (for use with aws)

You can also use wrapped kms data keys for encryption to protect the underlying kms key. Using this does functionality will incur kms costs and require kms setup. The region and profile parameters do not have to be specified.
If they are not specified, the values will be inferred in the order specified by boto3:

  1. Passing credentials as parameters in the boto.client() method
  2. Passing credentials as parameters when creating a Session object
  3. Environment variables
  4. Shared credential file (~/.aws/credentials)
  5. AWS config file (~/.aws/config)
  6. Assume Role provider
  7. Boto2 config file (/etc/boto.cfg and ~/.boto)
  8. Instance metadata service on an Amazon EC2 instance that has an IAM role configured.
from murmuration import kms_wrapped
plaintext = 'the quick brown fox jumps over the lazy dog'
key_alias = 'my kms key alias'
ciphertext = kms_wrapped.encrypt(plaintext, key_alias, region='us-west-1', profile='company')
decrypted = kms_wrapped.decrypt(ciphertext, region='us-west-1', profile='company')
assert decrypted == plaintext

contributing quick start

cd /path/to
git clone https://github.com/angry-penguins/murmuration
cd murmuration
make setup

to run tests, you will need to create a config file called conf/test.yml

aws:
  profile: an_existing_aws_profile

this profile will need to have a kms key that has been aliased to dev.

Once you have created that file, you can run tests using make:

make test

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

murmuration-1.4.tar.gz (7.4 kB view details)

Uploaded Source

File details

Details for the file murmuration-1.4.tar.gz.

File metadata

  • Download URL: murmuration-1.4.tar.gz
  • Upload date:
  • Size: 7.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/4.0.2 CPython/3.10.12

File hashes

Hashes for murmuration-1.4.tar.gz
Algorithm Hash digest
SHA256 d455c12a453d51f735a94b2414ae528c98c3d6514432870c4ab3f262c4091327
MD5 f64bc77e46a6ea9de66b6c19d80154bb
BLAKE2b-256 b749431dfd5cc51b5aa18c317e2f9bad35b8540a191e9f539bc2817a092dea18

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page