Add script to sign arbitrary files using the key stored in Secrets Manager #3

rix0rrr · 2018-05-30T15:13:32Z

This adds a script that loads a secret PGP key from secrets manager and signs arbitrary artifacts with it, creating detached (FILE.sig) signatures.

Not integrated with the buildspec.yaml yet. We should do that when we're builder superzips.

eladb · 2018-05-30T15:38:08Z

Please add a PR description that describes the motivation and some context

eladb · 2018-05-30T15:39:10Z

You might want to change the destination of this PR so it won't be against master as long as you haven't committed your changes to master, because at the moment it seems like this has all the doc changes as well (you can change the destination branch from the UI)

eladb · 2018-05-30T15:40:55Z

sign.sh

+passphrase=$(python -c "import json; print(json.load(file('$tmpdir/secret.txt'))['Passphrase'])")
+
+echo "Importing key..." >&2
+gpg --homedir $tmpdir --import <(python -c "import json; print(json.load(file('$tmpdir/secret.txt'))['PrivateKey'])")


is this something we need to install or add to awslabs/superchain?

Both gpg and AWS CLI are already in there.

okay, cool. I don't have it on my Mac but I guess signing is only done on the build fleet anyway.

eladb · 2018-05-30T15:41:40Z

sign.sh

+
+
+tmpdir=$(mktemp -d)
+trap "shred $tmpdir/* && rm -rf $tmpdir" EXIT


I don't shred on my machine

+have ?

Oh, macOS... :/

Yes... Try to keep dep surface to a minimum when writing bash scripts. You don't want to know what's up on Windows...

Well yeah, but neither do you have gpg on your machine, apparently. This is designed to run inside the Docker, and the Docker has shred.

eladb · 2018-05-30T15:42:14Z

sign.sh

+# Use secrets manager to obtain the key and passphrase into a JSON file
+echo "Retrieving key..." >&2
+aws --region us-east-1 secretsmanager get-secret-value --secret-id "$SECRET" --output text --query SecretString > $tmpdir/secret.txt
+passphrase=$(python -c "import json; print(json.load(file('$tmpdir/secret.txt'))['Passphrase'])")


I rather use node for JSON-related tasks (it is JS afterall)

eladb · 2018-05-30T15:42:54Z

sign.sh

+
+# Use secrets manager to obtain the key and passphrase into a JSON file
+echo "Retrieving key..." >&2
+aws --region us-east-1 secretsmanager get-secret-value --secret-id "$SECRET" --output text --query SecretString > $tmpdir/secret.txt


I rather we don't specify a region here. I believe the default region is the region where the build task runs, no?

But the secrets do live in a particular region (I've created them there), which is only incidentally the same one as the one where the build runs.

Does it make to make a cross-region call if our build fleet is deployed elsewhere or to put the secrets alongside each build fleet? (hypothetical of course).

Good question. I'll remove the region, with the result that the call will fail if we fail to colocate the build with the secrets. I guess that's preferable to "accidentally" placing them far away.

By the way, I will also add the key provisioning to the CI/CD stack.

eladb · 2018-05-31T09:48:17Z

Dry run?

eladb · 2018-05-31T09:48:44Z

packages/docs/package.json

@@ -2,16 +2,13 @@
  "name": "docs",
  "private": true,
  "version": "0.6.0",
-  "description": "AWS CDK Documentation",
+  "description": "Generates the documentation for all packages",


eladb · 2018-05-31T09:49:01Z

packages/docs/src/concepts.rst

@@ -50,26 +50,32 @@ to instantiate the ``StorageLayer`` construct.

 When you initialize a construct,
 add the construct to the construct tree by specifying the parent construct as the first initializer parameter,
-a unique (to your stack) identifier for the construct as the second parameter,
-and an optional set of properties for the final parameter,
+a unique identifier for the construct as the second parameter,


Still seeing doc updates here... something is weird

…nager

# This is the 1st commit message: Add MethodResponse support for aws-apigateway # This is the commit message aws#2: Remove Dockerfile that was no longer needed # This is the commit message aws#3: Update python base image from 3.6 to 3.6.5 # This is the commit message aws#4: Make the dockerfile work

# This is the 1st commit message: Add Identity Pool construct # This is the commit message #2: Bug fixes # This is the commit message #3: Bug fixes # This is the commit message #4: Formatting # This is the commit message #5: Add construct methods # This is the commit message #6: Remove flat # This is the commit message #7: Fix issues

Added Note 3 -Additional note that certain expected defaults for parameters may be different. **⚠ Note aws#3**: Expected defaults for certain parameters may be different with the hotswap parameter. For example, an ECS service's minimum healthy percentage will currently be set to 0. Please review the source accordingly if this occurs.

rix0rrr changed the title ~~Huijbers/signing~~ Add signing May 30, 2018

rix0rrr changed the title ~~Add signing~~ Add signing script May 30, 2018

eladb reviewed May 30, 2018

View reviewed changes

rix0rrr force-pushed the huijbers/signing branch from 19fa33f to 32a0dea Compare May 31, 2018 07:49

eladb reviewed May 31, 2018

View reviewed changes

Rico Huijbers added 2 commits May 31, 2018 13:32

Add script to sign arbitrary files using the key stored in Secrets Ma…

8b071e5

…nager

Update to use new secret naming scheme so we can have multiple keys

be15422

rix0rrr force-pushed the huijbers/signing branch from 32a0dea to be15422 Compare May 31, 2018 11:32

rix0rrr changed the title ~~Add signing script~~ Add script to sign arbitrary files using the key stored in Secrets Manager May 31, 2018

eladb approved these changes May 31, 2018

View reviewed changes

Remove region, use NodeJS instead of Python to pick apart the JSON

c79b719

rix0rrr merged commit 57698c2 into master May 31, 2018

rix0rrr deleted the huijbers/signing branch May 31, 2018 18:16

eladb mentioned this pull request Jun 21, 2018

CDK User Guide should document importing templates #163

Closed

mpiroc added a commit that referenced this pull request Jul 11, 2018

Attempt #3.

0ba8b49

chelma-amzn mentioned this pull request Aug 2, 2019

LoadBalancedFargateService Improvements #3270

Closed

eladb mentioned this pull request Sep 18, 2019

Cannot use tokens when tagging stacks #4106

Closed

NGL321 added the contribution/core This is a PR that came from AWS. label Sep 27, 2019

jd-carroll mentioned this pull request Sep 28, 2019

elbv2: Investigate NetworkLoadBalancer #4268

Closed

damonmaria mentioned this pull request Oct 1, 2019

All specification of ResourceTypes when deploying stack #4314

Closed

2 tasks

cseickel mentioned this pull request Jan 15, 2020

[aws-eks] Upgrading to v1.20.0 #5544

Closed

iwarshak mentioned this pull request May 28, 2020

ECSPatterns: Support switch for http->https redirect #5583

Closed

2 tasks

comcalvi mentioned this pull request Jul 29, 2020

feat(cfn-include): add support for the Fn::Sub function #9275

Merged

beatyt mentioned this pull request Nov 26, 2020

(general): hundreds of nested cdk.out/asset directories in %temp% broke Windows #11730

Closed

ncaq mentioned this pull request Jan 20, 2021

(aws-lambda-python) docker build is not working #12610

Closed

diegotry mentioned this pull request Jun 11, 2021

(aws-stepfunctions): L3 Construct for API Gateway HTTP/REST Api Backed by Step Functions #15081

Closed

2 tasks

Seiya6329 mentioned this pull request Jun 21, 2021

[appmesh] VirtualNode in separate stack from Mesh creates circular dependency #10049

Closed

Crycham mentioned this pull request Aug 5, 2022

ec2.Vpc to support using ipam #21333

Closed

2 tasks

tmokmss mentioned this pull request Sep 5, 2022

feat(lambda): allow to delete log group of a lambda function when it is removed #21820

Closed

4 tasks

vneekhra mentioned this pull request Jul 21, 2023

(NLB): NetworkLoadBalancer.fromLookup returning dummy NLBs #26463

Closed

natalie-white-aws mentioned this pull request Sep 29, 2023

(aws-cdk-lib/pipelines): CDKPipelines source / input change from v1 to v2 doesn't allow 5 sources #27359

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add script to sign arbitrary files using the key stored in Secrets Manager #3

Add script to sign arbitrary files using the key stored in Secrets Manager #3

rix0rrr commented May 30, 2018 •

edited

Loading

eladb commented May 30, 2018

eladb commented May 30, 2018

eladb May 30, 2018

rix0rrr May 31, 2018

eladb May 31, 2018

eladb May 30, 2018

rix0rrr May 31, 2018

eladb May 31, 2018

rix0rrr May 31, 2018

eladb May 30, 2018

eladb May 30, 2018

rix0rrr May 31, 2018

eladb May 31, 2018

rix0rrr May 31, 2018

eladb commented May 31, 2018

eladb May 31, 2018

eladb May 31, 2018



		tmpdir=$(mktemp -d)
		trap "shred $tmpdir/* && rm -rf $tmpdir" EXIT

Add script to sign arbitrary files using the key stored in Secrets Manager #3

Add script to sign arbitrary files using the key stored in Secrets Manager #3

Conversation

rix0rrr commented May 30, 2018 • edited Loading

eladb commented May 30, 2018

eladb commented May 30, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eladb commented May 31, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rix0rrr commented May 30, 2018 •

edited

Loading