Fetches and decrypts files from S3 bucket using AWS KMS
Initial idea for writing this tool was to have a way to decrypt files stored in S3 bucket using KMS master key and write them to a tmpfs mount. s3secrets uses KMS master key to decrypt data <=4kB in size.
Writing decrypted files to tmpfs mount is highly recommended.
You will need gb tool - http://getgb.io/.
git clone https://github.com/UKHomeOffice/s3secrets.git
cd s3secrets
gb build all
Here is an example of how to encrypt a TLS key file using aws cli. You have to specify which KMS master key you want to use to encrypt the data. When decrypting the data, s3secrets does not need to know which KMS master key to use though.
aws kms encrypt --key-id e19da26a-dde4-4575-8f94-b840794cdb62 \
--plaintext "$(cat my_tls_key.pem)" \
--query CiphertextBlob \
--output text | base64 -d > my_tls_key.pem.encrypted
aws s3 cp my_tls_key.pem.encrypted s3://my-bucket-name/prod
Configuration is provided via command line arguments.
$ s3secrets --help
Usage of s3secrets:
-bucket string
s3 bucket name with optional path
-file-suffix string
encrypted file suffix (default ".encrypted")
-output-dir string
output directory (default "/run/secrets")
-region string
aws region
-version
print version and exit
s3secrets must have access to write to the output directory. systemd.mount unit could be used to set up tmpfs mount points for different services.
$ s3secrets --region us-west-1 --bucket my-bucket-name/prod --output-dir /etc/etcd2/tls
# should see this output
Successfully decrypted my-bucket-name/prod/my_tls_key.pem.encrypted to /etc/etcd2/tls/my_tls_key.pem
Any contribution is welcome.