AWS KMS
Protect Secrets Manager connection details with AWS KMS
Keeper Secrets Manager integrates with AWS KMS in order to provide protection for Keeper Secrets Manager configuration files. With this integration, you can protect connection details on your machine while taking advantage of Keeper's zero-knowledge encryption of all you secret credentials.
- Encrypt and Decrypt your Keeper Secrets Manager configuration files with AWS KMS
- Protect against unauthorized access to your Secrets Manager connections
- Requires only minor changes to code for immediate protection. Works with all Keeper Secrets Manager Python SDK functionality
- Requires boto3 package
The Secrets Manager HSM modules are located in the Keeper Secrets Manager storage module which can be installed using pip
pip3 install keeper-secrets-manager-storage
boto3 is a prerequisite for the AWS KSM integration. Install it to your machine using pip.
pip3 install boto3
By default the boto3 library will utilize the default connection session setup with the AWS CLI with the
aws configure command. If you would like to specify the connection details, the two configuration files located at ~/.aws/config and ~/.aws/credentials can be manually edited.See the AWS documentation for more information on setting up an AWS session: https://docs.aws.amazon.com/cli/latest/reference/configure/
Alternatively, configuration variables can be provided explicitly as an access key using the
AwsSessionConfig data class and providing aws_access_key_id , aws_secret_access_key and aws_session_token variables.You will need an AWS Access Key to use the AWS KMS integration.
For more information on AWS Access Keys see the AWS documentation: https://aws.amazon.com/premiumsupport/knowledge-center/create-access-key/
Now that the AWS connection has been configured, you need to tell the Secrets Manager SDK to utilize the KMS as storage.
To do this, use
AwsKmsKeyvalueStorage as your Secrets Manager storage in the SecretsManager constructor.The storage will require an AWS Key ID, as well as the name of the Secrets Manager configuration file which will be encrypted by AWS KMS.
Example using default connection session
Example using a specified connection session
AWS_KMS_example_default.py
from keeper_secrets_manager_core import SecretsManager
from keeper_secrets_manager_hsm.storage_aws_kms import AwsKmsKeyValueStorage
key_id = 'c5[...]576'
config = AwsKmsKeyValueStorage(key_id, 'client-config.json') # default session
secrets_manager = SecretsManager(config=config, verify_ssl_certs=True)
all_records = secrets_manager.get_secrets()
AWS_KMS_example_custom.py
from keeper_secrets_manager_core import SecretsManager
from keeper_secrets_manager_hsm.storage_aws_kms import AwsKmsKeyValueStorage
aws_session_cfg = AwsSessionConfig(
aws_access_key_id="AK[...]FIF",
aws_secret_access_key="/[...]/g3",
region_name="us-east-2")
config = AwsKmsKeyValueStorage(
key_id='e9[...]567',
config_file_location='client-config.json',
aws_session_config=aws_session_cfg)
secrets_manager = SecretsManager(config=config, verify_ssl_certs=True)
all_records = secrets_manager.get_secrets()
You're ready to use the KSM integration
👍
Once setup, the Secrets Manager AWS KMS integration supports all Secrets Manager Python SDK functionality. Your code will need to be able to access the AWS KMS APIs in order to manage the decryption of the configuration file when run.
Last modified 11mo ago