Closed stevehodgkiss closed 5 years ago
@burke is this something you'd consider adding to EJSON?
I think this is a great usage pattern but TBH I would implement it as a wrapper and keep EJSON doing as little as possible, especially since it seems like it would be relatively simple as a wrapper script. I just merged the key-from-stdin
PR; I'll push a new release out in the next hour or two.
This exists @stevehodgkiss > https://github.com/adrienkohlbecker/ejson-kms
Ah interesting, thanks, I hadn't seen that. We wrote a ruby wrapper around EJSON to provide this functionality - https://github.com/envato/ejson_wrapper
Proposal: Support for storing the private key encrypted with a given KMS key inside the EJSON document. Decryption of secrets would require permission to decrypt with the KMS key, not access to the unencrypted private key on disk as before.
This is similar to how sops works in how it wraps the private key with KMS and stores it in the yaml file.
Benefits (for applications on AWS):
I imagine it working like this: