Skip to main content

Utility to decrypt and encrypt secrets using AWS KMS keys that is compatible with pydantic models

Project description


PyPI version Upload Python Package codecov

Utility to decrypt and encrypt secrets using AWS KMS keys that also integrates with pydantic models which allows for encrypted values to be stored in .env files and be decrypted at runtime.


From PyPi:

$ pip install pydantic-kms-secrets



Encrypt a secret:

$ pks -k your-kms-key-id -v my-secret-password -e

Decrypt a secret:

$ pks -k your-kms-key-id -v your-encrypted-secret -d

Help docs:

$ pks --help
usage: pks [-h] [-k KEY_ID] -v VALUE [-e] [-d]

Tool to encrypt and decrypt secrets via a KMS key

optional arguments:
  -h, --help            show this help message and exit
  -k KEY_ID, --key-id KEY_ID
                        ID of the KMS key to use
  -v VALUE, --value VALUE
                        The value to be encrypted
  -e, --encrypt         Set to encrypt value
  -d, --decrypt         Set to decrypt value


Pydantic KMS Secrets is able to integrate and add functionality on top of Pydantic's dotenv extension by allowing you to store encrypted values in your .env files and decrypt them at runtime. A basic implementation would look something like:

Pydantic Settings Model

from pydantic import BaseSettings
from pydantic_kms_secrets import KMSSecretStr, decrypt_kms_secrets

class Settings(BaseSettings):
    env: str
    secrets_kms_key_id: str  # This model attribute must exist to decrypt secrets
    kms_secret_1: KMSSecretStr
    kms_secret_2: KMSSecretStr

    class Config:
        env_file = ".env"

# Don't forget to call decrypt_kms_secrets, if you don't the secrets will not be decrypted
settings = decrypt_kms_secrets(Settings())

.env File


SECRETS_KMS_KEY_ID="your-kms-key-id"  # This environment variable must be set to decrypt secrets

KMSSecretStr Class

The KMSSecretStr class is almost identical to the SecretStr type in pydantic.

# This example uses the settings value from the python example above

# Standard access methods will not display the secret
#> env='prod' secrets_kms_key_id='your-kms-key-id' kms_secret_1=KMSSecretStr('**********') kms_secret_2=KMSSecretStr('**********')
#> **********
    'env': 'prod',
    'secret_kms_key_id': 'your-kms-key-id',
    'kms_secret_1': KMSSecretStr('**********'),
    'kms_secret_2': KMSSecretStr('**********'),
#> {"env": "prod", "secret_kms_key_id": "your-kms-key-id", "kms_secret_1": "**********", "kms_secret_2": "**********"}

# Use get_secret_value method to see the secret's content.
#> my-first-encrypted-secret
#> my-second-encrypted-secret

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

pydantic_kms_secrets-0.3.0.tar.gz (4.4 kB view hashes)

Uploaded source

Built Distribution

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page