Support AWS KMS Encryption Context #76
Conversation
| @@ -178,6 +178,9 @@ def main(): | |||
| help="path to config file, disable recursive search" | |||
| " (default: {default})" | |||
| .format(default=DEFAULT_CONFIG_FILE)) | |||
| argparser.add_argument('--encryption-context', dest='context', | |||
| help="KMS encryption context: " | |||
| "key-value pair dict encoded in JSON") | |||
There was a problem hiding this comment.
I haven't used KMS encryption contexts, but would there be a way to expand this to not require JSON on the command line but take individual parameters instead? We already have a custom csv format for specifying multiple kms and pgp on the command line, and I'd prefer to avoid introducing another format.
|
This is a interesting feature, thanks for sending the patch! Could you add some documentation to the README to explain how this is meant to be used? I'd also suggest adding a couple unit tests. |
|
@jvehent thanks for the comment. the code is refactored to use context string like "Key1:Value1,Key2:Value2" to better align with existing convention. also I have update the README.md and unit test. regrading to encryption context, you may be interested in related doc from credstash and sneaker (both of them support encryption context as well) |
|
|
||
| SOPS has the ability to use AWS KMS key policy and encryption context | ||
| <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html> | ||
| to further fine control access under the same master key. |
There was a problem hiding this comment.
to refine the access control of a given KMS master key.
|
This is getting close, I just have a couple comments on the documentation. Once you fix them, I'll merge the patch and we can test it for a couple weeks before releasing 1.14. |
|
Thanks for the patches! The build is breaking before of unrelated issues, so I'm going to merge this and fix the rest in master. This looks neat, much appreciated! + 💯 👍 |
some reference on encryption context added:
http://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html
http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html