For senza files with sensitive parameters, those parameters would ideally be encrypted.
It is possible to use KMS encryption to avoid having those values as plain text in the senza definition file. This, however, means that those parameters must be decrypted before CloudFormation orchestration, and it will happen on a local machine running senza, or through lizzy.
The suggestion is to use the prefix senza:kms: to clearly identify these parameters.
For reasons of simplicity, those parameters should be in the SenzaInfo section.
For senza files with sensitive parameters, those parameters would ideally be encrypted.
It is possible to use KMS encryption to avoid having those values as plain text in the senza definition file. This, however, means that those parameters must be decrypted before CloudFormation orchestration, and it will happen on a local machine running senza, or through lizzy.
The suggestion is to use the prefix
senza:kms:
to clearly identify these parameters. For reasons of simplicity, those parameters should be in theSenzaInfo
section.Ex.:
A concrete example for this functionality is ElastiGroup's
SpotinstAccessToken
parameter: https://github.com/zalando-stups/senza/blob/master/examples/elastigroup.yaml#L5The inspiration for this approach comes from Taupage's use of KMS encryption. In that case the prefix is
aws:kms: