Skip to main content

Encrypt project secrets

Project description

Circle CI

WARNING: this software is in alpha state, use with caution.

Utility for keeping your secrets encrypted. Also has a Go version.

For example, you have the following configuration file

MY_SECRET=VerySecretValue!

but you can’t include that file in VCS because then your secret value would be exposed.

With secretcrypt, you can encrypt your secret using your AWS KMS master key aliased MyKey:

$ encrypt-secret kms alias/MyKey
Enter plaintext: VerySecretValue! # enter
kms:region=us-east-1:CiC/SXeuXDGRADRIjc0qcE... # shortened for brevity

# --- or --
$ echo "VerySecretValue!" | encrypt-secret kms alias/MyKey
kms:region=us-east-1:CiC/SXeuXDGRADRIjc0qcE... # shortened for brevity
# only use piping when scripting, otherwise your secrets will be stored
# in your shell's history!

use that secret in my config file

from secretcrypt import Secret
MY_SECRET=Secret('kms:region=us-east-1:CiC/SXeuXDGRADRIjc0qcE...')  # shortened for brevity

and get the plaintext like

print MY_SECRET.get()
# VerySecretValue!

If you are using very sensitive secrets, you can ensure the plaintext is not kept in memory and is only encrypted on demand by using a stricter version:

from secretcrypt import StrictSecret
MY_SECRET=StrictSecret('kms:region=us-east-1:CiC/SXeuXDGRADRIjc0qcE...')  # shortened for brevity

and get the plaintext like

print MY_SECRET.decrypt()
# VerySecretValue!

KMS

The KMS option uses AWS Key Management Service. When encrypting and decrypting KMS secrets, you need to provide which AWS region the is to be or was encrypted on, but it defaults to us-east-1.

So if you use a custom region, you must provide it to secretcrypt:

encrypt-secret kms --region us-west-1 alias/MyKey

Local encryption

This mode is meant for local and/or offline development usage. It generates a local key in your %USER_DATA_DIR% (see appdirs), so that the key cannot be accidentally committed to CVS.

It then uses that key to symmetrically encrypt and decrypt your secrets.

History

0.4 (2016-03-02)

  • plaintexts are now returned as strings not as bytes

0.3 (2016-03-02)

  • BREAKING CHANGE: introduced new semantics for Secret and a new StrictSecret

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

secretcrypt-0.4.tar.gz (11.1 kB view details)

Uploaded Source

File details

Details for the file secretcrypt-0.4.tar.gz.

File metadata

  • Download URL: secretcrypt-0.4.tar.gz
  • Upload date:
  • Size: 11.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No

File hashes

Hashes for secretcrypt-0.4.tar.gz
Algorithm Hash digest
SHA256 1a127de8893b95d75527ab65e32e237cb1d9935579d1f8e9f213b235589f6a1e
MD5 dde487be4dcf2daf4a9ae95c0a0e089f
BLAKE2b-256 e083d0b504c4216390d78cceb17cee781e117dba7398c53ffde16362416ce8c2

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page