fugue / credstash

A little utility for managing credentials in the cloud
Apache License 2.0
2.06k stars 214 forks source link

Support for passing a grant token #307

Open weaversam8 opened 2 years ago

weaversam8 commented 2 years ago

When using AWS KMS, Credstash advocates for using Key Policies and Grants to control access to the KMS Master Key used to encrypt your data. This enables permissions to be granted on a per-secret basis (when enforced by the Key Policy or Grant.)

Grants in KMS (like several other KMS features) are eventually-consistent. This means that there may be a period after creating a grant where credstash will be unable to access the KMS key, despite permissions being provided by the grant.

To mitigate this, KMS allows users to provide a Grant token in their request to the KMS API, which ensures the request will succeed on the first attempt. Credstash should surface a method to provide grant tokens (perhaps through a CLI flag or environment variable) to ensure users don't have to wait / retry credstash operations after receiving a grant.