search

rackerlabs / lambda-uploader

Helps package and upload Python lambda functions to AWS
Apache License 2.0
271 stars 56 forks source link

Support customer-managed KMS key for environment variables #123

Open brandond opened 7 years ago

brandond commented 7 years ago

Optional, of course

jarosser06 commented 7 years ago

@brandond Would you mind elaborating on what you are thinking with this request.

brandond commented 7 years ago

See this section of the documentation: http://docs.aws.amazon.com/lambda/latest/dg/env_variables.html#env_encrypt

If you use the Lambda management console and enable environment variable encryption, the console has some back-end functionality to encrypt the plaintext content of the variables that you enter into the web form using the KMS key specified. The ciphertext is then stored in the lambda configuration The Lambda code you write then has to make some KMS calls to decrypt the contents. Sample code for this is provided in the console as well.

From a lambda-uploader perspective, the implementation should probably function similarly - make a KMS call to encrypt the plaintext variable contents, using the specified KMS key, and store the ciphertext in place of the original contents.

martinb3 commented 7 years ago

From a lambda-uploader perspective, the implementation should probably function similarly - make a KMS call to encrypt the plaintext variable contents, using the specified KMS key, and store the ciphertext in place of the original contents.

It seems like this would require we:

  1. Have some way to mark which secrets should be encrypted
  2. Prompt for the plaintext version of those secrets
  3. Have a feature or wrap the aws kms CLI feature so that we can encipher the secrets
  4. Be able to set the ciphertext in an environment variable(s)
nsaje commented 4 years ago

could use https://github.com/Zemanta/py-secretcrypt for this