Closed gclawes closed 7 months ago
Hey @gclawes, sounds like we need to update to AWS v2 first (unless there's a way to make this work with v1 too)? I've opened an issue to track that: https://github.com/smallstep/crypto/issues/405.
Ahh, didn't catch that it's still on v1, my bad. Thanks for looking into this!
It looks like it may still be possible in v1: https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html
SDK for Go 1.x (V1) | Yes | To use shared config file settings, you must turn on loading from the config file; see Sessions.
Hi, @gclawes, I moved the issue to the step-km-plugin
so it can be fixed with a new version of crypto once https://github.com/smallstep/crypto/pull/408 gets merged and tagged.
This issue is now fixed in the main branch.
Note that if you have more than one profile in ~/.aws/config
you will need to select the right one like this `step kms create --json 'awskms:profile=foo;name=my-key'
@maraino tools like Granted set the AWS_PROFILE
environment variable, will that work as an alternative to 'awskms:profile=foo;...
?
@maraino tools like Granted set the
AWS_PROFILE
environment variable, will that work as an alternative to'awskms:profile=foo;...
?
Yes, that works.
Steps to Reproduce
Configure AWS profile with
credential_process
(using a tool like GrantedAttempt an operation with a
step*
binary using AWSKMS:step-kms-plugin
:step certificate create
(pre-created KMS key):credential_process
:$ export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE" $ export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" $ export AWS_SESSION_TOKEN="AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE"
$ step kms create --json --kms 'awskms:region=us-east-1' step-ca-test { "name": "awskms:key-id=1234567-abcd-1234-dcba-1234567890", "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3b1V3/ikBR/pmFI7xFJ4pEKGwS+rpOw7//pveoHgx/FVwuAaOaVcw/PlThZb7/jircsnrugsr7wpjolyVAUHsw==\n-----END PUBLIC KEY-----\n" }
$ step --version Smallstep CLI/0.25.1 (darwin/arm64) Release Date: 2023-11-29 09:17 UTC
$ step-kms-plugin version 🔐 step-kms-plugin/0.9.2 (darwin/arm64) Release Date: 2023-11-10T22:20:48Z