AWS KMS
Protect Secrets Manager connection details with AWS KMS
Keeper Secrets Manager integrates with AWS KMS in order to provide protection for Keeper Secrets Manager configuration files. With this integration, you can protect connection details on your machine while taking advantage of Keeper's zero-knowledge encryption of all your secret credentials.
Features
Encrypt and Decrypt your Keeper Secrets Manager configuration files with AWS KMS
Protect against unauthorized access to your Secrets Manager connections
Requires only minor changes to code for immediate protection. Works with all Keeper Secrets Manager Python SDK functionality
Prerequisites
Supports the Python Secrets Manager SDK
Requires boto3 package
Setup
1. Install KSM Storage Module
The Secrets Manager HSM modules are located in the Keeper Secrets Manager storage module which can be installed using pip
2. Install boto3
boto3 is a prerequisite for the AWS KSM integration. Install it to your machine using pip.
3. Configure AWS Connection
By default the boto3 library will utilize the default connection session setup with the AWS CLI with the aws configure
command. If you would like to specify the connection details, the two configuration files located at ~/.aws/config
and ~/.aws/credentials
can be manually edited.
See the AWS documentation for more information on setting up an AWS session: https://docs.aws.amazon.com/cli/latest/reference/configure/
Alternatively, configuration variables can be provided explicitly as an access key using the AwsSessionConfig
data class and providing aws_access_key_id
, aws_secret_access_key
and aws_session_token
variables.
You will need an AWS Access Key to use the AWS KMS integration.
For more information on AWS Access Keys see the AWS documentation: https://aws.amazon.com/premiumsupport/knowledge-center/create-access-key/
4. Add AWS KMS Storage to Your Code
Now that the AWS connection has been configured, you need to tell the Secrets Manager SDK to utilize the KMS as storage.
To do this, use AwsKmsKeyvalueStorage
as your Secrets Manager storage in the SecretsManager
constructor.
The storage will require an AWS Key ID, as well as the name of the Secrets Manager configuration file which will be encrypted by AWS KMS.
Using the AWS KMS Integration
Once setup, the Secrets Manager AWS KMS integration supports all Secrets Manager Python SDK functionality. Your code will need to be able to access the AWS KMS APIs in order to manage the decryption of the configuration file when run.
Check out the KSM SDKs documentation for more examples and functionality
Last updated